Trying to set up a site-to-site VPN between two Routerboards. Finding it extremely difficult to find any consistency in the various guides out there. Many guides from before 6.44 which, as I understand, changed a lot of IPsec stuff.
I have two sites in a lab environment.
- Site 1 with private network 192.168.120.1/24 and public facing address 192.168.55.119
- Site 2 with private network 192.168.130.1/24 and public facing address 192.168.55.177
The plan is to add a third site, and all three sites should be able to communicate through VPNs.
Everything in either private network should be able to reach everything in the other. Internet traffic should not get routed via any VPN.
I’ve currently got the following configuration, which seems to work… but I don’t really know why because, again, inconsistent information.
My main concerns and questions are:
- Are the NAT rules necessary? I’ve seen a few alternatives here, such as adding a no-track raw rule. What’s the best option? I’m going to use a fasttrack rule.
- Probably related to above point. I can pick a no-track chain for IPsec identities. How do I use that?
- I thought I had to explicitly configure either site as the passive peer, but I guess not? Does it matter which side I configure as passive?
- A few guides make use of mode configs, but I do not use them here. When are they required and how do I employ them?
Site 1
/system identity set name=Site-1
/ip address add address=192.168.120.1/24 comment=DEFAULT interface=ether2 network=192.168.120.0
/ip pool add name=lan-dhcp ranges=192.168.120.101-192.168.120.199
/ip dhcp-server network add address=192.168.120.0/24 comment=DEFAULT gateway=192.168.120.1
/ip ipsec
profile add dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 name=s2s-vpn
proposal add auth-algorithms=sha512,sha256,sha1 enc-algorithms=aes-256-cbc name=s2s-vpn pfs-group=none
peer add address=192.168.55.177/32 exchange-mode=ike2 name=site2 profile=s2s-vpn
identity add generate-policy=port-strict peer=site2 secret=sesam
policy add dst-address=192.168.130.0/24 peer=site2 proposal=4r-s2s-vpn src-address=192.168.120.0/24 tunnel=yes
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.130.0/24 src-address=192.168.120.0/24
add action=masquerade chain=srcnat out-interface=ether1
Site 2
/system identity set name=Site-2
/ip address add address=192.168.130.1/24 comment=DEFAULT interface=ether2 network=192.168.130.0
/ip pool add name=lan-dhcp ranges=192.168.130.101-192.168.130.199
/ip dhcp-server network add address=192.168.130.0/24 comment=DEFAULT gateway=192.168.130.1
/ip ipsec
profile add dh-group=modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 name=s2s-vpn
proposal add auth-algorithms=sha512,sha256,sha1 enc-algorithms=aes-256-cbc name=s2s-vpn pfs-group=none
peer add address=192.168.55.119/32 exchange-mode=ike2 name=site1 profile=s2s-vpn
identity add generate-policy=port-strict peer=site1 secret=sesam
policy add dst-address=192.168.120.0/24 peer=site1 proposal=4r-s2s-vpn src-address=192.168.130.0/24 tunnel=yes
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.120.0/24 src-address=192.168.130.0/24
add action=masquerade chain=srcnat out-interface=ether1