Site to Site VPN - local DHCP clients not connecting

RouterOS Beginner Basics
1

Hello All,

I hope someone can help me with this please:

I recently bought some RB751G-2HnD routers to use to set up a VPN across three sites where each site has a static public IP address.

So far I have set up the RB devices on two of the sites. Everything was working normally on each site and DHCP clients on each site were connecting normally to the DHCP server on the bridge-local interface of each local router until I set up a site to site VPN over an IPSEC tunnel between the two RB devices by following the instructions on the article http://wiki.mikrotik.com/wiki/Manual:IP/IPsec

The site to site VPN is working well but I have noticed that local DHCP clients are not successfully connecting to the network.

I’m guessing that the problem is probably that I shouldn’t have two DHCP servers on the network and instead I guess I should have just one DHCP server and use the DHCP relays but I’m not sure how to do this. I’ve had a look at the article on http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Relay but I guess I’m doing something wrong.

Anyway, here is a synopsis of my configuration:

Two sites:

Site 1 router Public IP address a.a.a.a
Site 1 router local IP address 192.168.1.254
Site 1 local network addresses are 192.168.1.x

Site 2 router Public IP address b.b.b.b
Site 2 router local IP address 192.168.2.254
Site 2 local network addresses are 192.168.2.x

Site to site IPSEC Tunnel VPN established between Site 1 and Site 2 using instructions from article http://wiki.mikrotik.com/wiki/Manual:IP/IPsec

How do I set up DHCP so that local DHCP clients will connect to the following pools?
Site 1: 192.168.1.1 to 192.168.1.99
Site 2: 192.168.2.1 to 192.168.2.99

Many thanks for your help.

2

Can you show which are the firewall rules you’re using?

In site 1 you should do:

/ip firewall filter add action=accept chain=input disabled=no src-address=192.168.2.0/24
/ip firewall nat add action=accept chain=srcnat disabled=no dst-address=192.168.2.0/24 src-address=192.168.1.0/24

And vice-versa in site 2.

3

Hi, thanks for your reply.

I already had that NAT rule in place so I added the filter rule as you suggested but it doesn’t seem to make a difference. I’m sitting at site 2 at the moment and I tried logging on with a DHCP client (specifically an iPhone). I can see that the device is assigned an IP address but it doesn’t properly complete the connection and doesn’t successfully use the network. Any other suggestions please?

Here are the current filter and NAT rules on both sites:


Site 1:

[admin@ocr01] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; default configuration
chain=input action=accept protocol=icmp

1 ;;; default configuration
chain=input action=accept connection-state=established

2 ;;; default configuration
chain=input action=accept connection-state=related

3 ;;; default configuration
chain=input action=drop in-interface=ether1-gateway

4 chain=input action=accept src-address=192.168.2.0/24
[admin@ocr01] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=accept to-addresses=0.0.0.0 src-address=192.168.1.0/24
dst-address=192.168.2.0/24 out-interface=pppoe-out1

1 ;;; default configuration
chain=srcnat action=masquerade out-interface=pppoe-out1


Site 2:

[admin@ckr01] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; default configuration
chain=input action=accept protocol=icmp

1 ;;; default configuration
chain=input action=accept connection-state=established

2 ;;; default configuration
chain=input action=accept connection-state=related

3 ;;; default configuration
chain=input action=drop in-interface=ether1-gateway

4 chain=input action=accept src-address=192.168.1.0/24
[admin@ckr01] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=accept to-addresses=0.0.0.0 src-address=192.168.2.0/24
dst-address=192.168.1.0/24

1 ;;; default configuration
chain=srcnat action=masquerade out-interface=ether1-gateway

Please let me know if there is any more information needed to diagnose this problem.

Thanks again.