Sync with ipsec problem

RouterOS Storage
1

Hello
I try new featire rose-storage.
Scenraio is like this

One site RB3011 (192.168.200.1/23) (v7.21) with public IP
Inside network is CHR 192.168.200.102/24 with Dude

Other site CCR1009 (192.168.88.1/24) with public IP
Inside network is RB1100Dx4 (192.168.88.252/24) with Dude-backup

Connectio betwen Site is WireGuard RB3011 (90.90.90.254/24) and CCR1009 (90.90.90.88/24)
ping work in both direction, 192.168.200.102 can ping 192.168.88.252 and oposite.

Now, I create file on CHR and want to re-sync some file on RB1100Dx4
Setup is good on RAID, file etc.. BUT problem in on IPSEC during connection so sync is newer done, PHASE 2. IPSEC is on defaul didn’t use it.

I send export of both sites (RB3011, and CCR1009) so someone can help where is problem

CHR
/file rsync-daemon
set enabled=yes
/file sync
add local-path=pcie2/Baza mode=upload password=dude1910 remote-address=192.168.88.252 remote-path=raid2/Baza user=dude
/ip firewall connection tracking
set udp-stream-timeout=4m udp-timeout=2m

Config of both routers are in file, thay are big so not to spam. There is other thing also inside, but didn’t want to delete anything

ccr1009.rsc (59.9 KB)

rb3011.rsc (76.7 KB)

This is on Log on RB1100Dx4

image
image1063×308 11.8 KB

It doesnt reach phese2 so probabli some NAT is problem
So any help is good. Ping is OK in both direction. Also I can ssh from CHR to RB1100dx4 and oposite.

2

If I try same sync file betwen 2 devices in same network, it work
So it mean that is something in IPsec polices,firewall,nat
Strange is that i have ping on both sites

All IPsec setup on all devices is default.

3

Why do you use public United States Department of Defense (DoD) or Microsofts owned addresses?

add name=IKEv2-pool ranges=21.21.21.245-21.21.21.253
/interface wireguard peers
add allowed-address=20.99.99.1/32

You should use private pools for internal matters.
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16

4

I use it in priveta, BUT You are right…i will change.

I meanwile i solve this proble.. NAT and IP/Filter was’t ok. That is why ipsec can’t work…

5

Maybe you won't have problems accessing DoD pages :slight_smile: but Microsoft's tools may fail as they like to contact "some unknown" services that are used eg. to show "you have Internet access" icon.

1 Like