I'm configuring site to site VPN, and I can ping the local gateway on router B from a machine on router A, router B can ping router A's internal IP, but router B cannot ping my computer.
My config is as such - computer IP 192.168.102.200 -> gateway 192.168.102.1 (router A LAN) -> internet -> gateway 192.168.101.1 (router B LAN), with an IPSec tunnel configured that should (in theory) allow the two LANs to communicate.
I can ping from 192.168.102.200 to 192.168.101.1
I can ping from 192.168.102.1 to 192.168.101.1
I can ping from 192.168.101.1 to 192.168.102.1
I can NOT ping from 192.168.101.1 to 192.168.102.200.
The current configs are effectively identical, barring the WAN IP set and the LAN IPs used. I'm providing router B's config but could provide router A's config as well if it would help.
Basically no hardening/firewall configuration has as yet been performed on these devices.
Export from Router B is as follows:
apr/03/2017 15:26:32 by RouterOS 6.38.5
software id = SKFI-G70G
/interface bridge
add name=Bridge-Guest
add name=Bridge-Internal
/interface ethernet
set [ find default-name=ether1 ] comment="WAN Port"
set [ find default-name=ether2 ] comment="LAN Master Port"
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
set [ find default-name=ether6 ] master-port=ether2
set [ find default-name=ether7 ] master-port=ether2
set [ find default-name=ether8 ] master-port=ether2
set [ find default-name=ether9 ] master-port=ether2
set [ find default-name=ether10 ] master-port=ether2
set [ find default-name=ether11 ] master-port=ether2
set [ find default-name=ether12 ] master-port=ether2
set [ find default-name=ether13 ] master-port=ether2
set [ find default-name=ether14 ] master-port=ether2
set [ find default-name=ether15 ] master-port=ether2
set [ find default-name=ether16 ] master-port=ether2
set [ find default-name=ether17 ] master-port=ether2
set [ find default-name=ether18 ] master-port=ether2
set [ find default-name=ether19 ] master-port=ether2
set [ find default-name=ether20 ] master-port=ether2
set [ find default-name=ether21 ] master-port=ether2
set [ find default-name=ether22 ] master-port=ether2
set [ find default-name=ether23 ] master-port=ether2
set [ find default-name=ether24 ] master-port=ether2
/ip ipsec policy group
set
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256 enc-algorithms=aes-256-ctr
/ip pool
add name=dhcp_pool0 ranges=192.168.101.21-192.168.101.200
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=Bridge-Internal lease-time=3d name=dhcp1
/interface bridge port
add bridge=Bridge-Internal interface=ether2
add bridge=Bridge-Internal interface=wlan1
/ip address
add address=192.168.101.1/24 comment="Internal DHCP Gateway" interface=Bridge-Internal network=192.168.101.0
add address=192.168.0.80/24 comment="WAN Static IP" interface=ether1 network=192.168.0.0
/ip dhcp-server network
add address=192.168.101.0/24 dns-server=208.67.222.222,208.67.220.220 gateway=192.168.101.1
/ip firewall nat
add action=accept chain=srcnat comment="Site to Site VPN" dst-address=192.168.101.0/24 src-address=192.168.102.0/24
add action=masquerade chain=srcnat comment="WAN Masquerading" out-interface=ether1
/ip ipsec peer
add address=192.168.0.81/32 comment="Site to Site" dpd-interval=disable-dpd enc-algorithm=aes-256 hash-algorithm=sha256 nat-traversal=no secret=Test
/ip ipsec policy
add comment="Site to Site VPN" dst-address=192.168.102.0/24 sa-dst-address=192.168.0.81 sa-src-address=192.168.0.80 src-address=192.168.101.0/24 tunnel=yes
/ip route
add distance=1 gateway=192.168.0.1
add distance=1 dst-address=192.168.102.0/24 gateway=192.168.0.81 pref-src=192.168.0.80
/system clock
set time-zone-name=America/Chicago