I have 2 RB2011 that are connected via OpenVPN. Separate subnets, except for the fact that on ether1/WAN1 on the client side it is on 192.168.0.0/24 and on the Server side there are a few devices static on 192.168.0.0/24 on the bridge/LAN side. From the client side I can see Server side subnets perfectly. Everything works. But from behind the server I cannot hit the client side subnet. It just dies. From the server RB2011 I can hit the client subnet, but not from behind the server RB2011. Cannot figure out what is wrong. Did the srcnat and it mirrors, but one side doesn't work. Ping hits the server MT and then nothing.
Server side
/ip address> print
ADDRESS NETWORK INTERFACE
0 192.168.0.1/24 192.168.0.0 bridge
1 192.168.100.1/24 192.168.100.0 bridge
2 I 192.168.10.1/24 192.168.10.0 *F00007
3 D 172.0.121.10/24 172.0.121.0 WAN1
4 D 192.168.10.1/32 192.168.10.2
/ip firewall filter print
0 D ;;; special dummy rule to show fasttrack counters chain=forward
1 ;;; defconf: accept ICMP chain=input action=accept protocol=icmp log=no log-prefix=""
2 ;;; defconf: accept established,related chain=input action=accept connection-state=established,related log=no log-prefix=""
3 ;;; defconf: fasttrack chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""
4 ;;; defconf: accept established, related chain=forward action=accept connection-state=established,related log=no log-prefix=""
5 chain=input action=accept protocol=tcp dst-port=1194 log=no log-prefix=""
/ip firewall nat print
1 chain=srcnat action=accept src-address=192.168.100.0/24 dst-address=192.168.200.0/24 log=no log-prefix=""
2 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface=WAN1 log=no log-prefix=""
/ip firewall mangle print
0 D ;;; special dummy rule to show fasttrack counters chain=prerouting
1 D ;;; special dummy rule to show fasttrack counters chain=forward
2 D ;;; special dummy rule to show fasttrack counters chain=postrouting
3 XI chain=forward action=accept protocol=tcp out-interface=all-ppp log=no log-prefix=""
4 XI chain=forward action=accept protocol=tcp out-interface=all-ppp log=no log-prefix=""
/ip route print
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 172.0.121.1 0
1 ADC 172.0.121.0/24 172.0.121.10 WAN1 0
2 ADC 192.168.0.0/24 192.168.0.1 bridge 0
3 ADC 192.168.10.2/32 192.168.10.1 0
4 ADC 192.168.100.0/24 192.168.100.1 bridge 0
5 A S 192.168.200.0/24 192.168.10.2 1
Client Side
/ip route print
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 192.168.0.254 1
1 ADC 192.168.0.0/24 192.168.0.15 ether1 0
2 ADC 192.168.10.1/32 192.168.10.2 VPN 0
3 A S 192.168.101.0/24 192.168.10.1 1
4 ADC 192.168.200.0/24 192.168.200.1 bridge 0
/ip firewall nat print
0 chain=srcnet action=accept src-address=192.168.200.0/24 dst-address=192.168.100.0/24 log=no log-prefix=""
1 chain=srcnat action=accept src-address=192.168.200.0/24 dst-address=192.168.101.0/24 log=no log-prefix=""
2 ;;; defconf: masquerade chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""
3 chain=srcnet action=accept src-address=192.168.200.0/24 dst-address=192.168.100.0/24 log=no log-prefix=""
/ip firewall filter print
0 D ;;; special dummy rule to show fasttrack counters chain=forward
1 ;;; defconf: accept ICMP chain=input action=accept protocol=icmp log=no log-prefix=""
2 ;;; defconf: accept established,related chain=input action=accept connection-state=established,related log=no log-prefix=""
3 chain=input action=accept in-interface=VPN=no log-prefix=""
4 ;;; defconf: drop all from WAN chain=input action=drop in-interface=ether1 log=no log-prefix=""
5 ;;; defconf: fasttrack chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""
6 ;;; defconf: accept established,related chain=forward action=accept connection-state=established,related log=no log-prefix=""
7 ;;; defconf: drop invalid chain=forward action=drop connection-state=invalid log=no log-prefix=""
8 ;;; defconf: drop all from WAN not DSTNATed chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether1 log=no log-prefix=""
9 chain=input action=accept log=no log-prefix=""
/ip address print
ADDRESS NETWORK INTERFACE
0 192.168.200.1/24 192.168.200.0 ether2-master
1 D 192.168.0.15/24 192.168.0.0 ether1
2 D 192.168.10.2/32 192.168.10.1 VPN
I feel like I am missing something stupid, but I can't find it.