In the following scenario, computer A cannot browse computer B resources. The traffic goes over two EOIP tunnels built on top of PPTP tunnels. The mikrotik 1 and 3 act like PPTP clients to mikrotik 3 (PPTP server)
I exported the configuration as well from all three mikrotiks.
PPTP connections between mikrotik 1 and mikrotik 2, also between mikrotik 3 and mikrotik 2 are running.
EOIP tunnels on top of PPTP connections are also running.
on Mikrotik 1 and Mikrotik 3 there are bridges with eoip interfaces in them along with Ether4 (mikrotik 1) and Ether5 (mikrotik 3) in it.
For some reasons the network traffic between Computer A and B does’t work. I suspect firewall filter rules, forward chain. Please see the configuration of all three mikrotiks
Fair enough. But why not just use IPSec directly on the EoIP interface with a shared-secret? This seems simpler/cleaner, and perhaps faster, than PPTP tunnels.
Mikrotik 1 is behind NAT. It is basically connected to mobile phone hotspot or LTE dongle. The public IP address of the mobile phone or LTE dongle can change frequently.
Potentially, Mikrotik 3 will be also behind NAT (currently is with public IP address on one of its interfaces)
As far as I know, you have to have permanent IP addresses for establishing EOIP tunnels and this would not be the case for dynamic public IP addresses on LTE dongles or mobile phone hotspots in front of Mikrotik 1, as of now, and in front of Mikrotik 3, in near future.
PPTP has an advantage as it overcomes the problem of dynamic IP addresses for running EOIP on clients (Mikrotik 1 and 3)
.
.
What you are saying is still nonsensical once you open the PPTP tunnels those tunnels have endpoints which you can use to establish the EOIP and it doesn’t expose Mikrotik 2
Router 1 has an IP 172.16.1.2
Router 3 has an IP 172.16.2.2
All you need is a static route in router 1 and 3 so they can IP route to each other
Agreed, even with PPTP, one end still need to be public IP. Or otherwise routable over an internal network as noted. PPTP still uses GRE, like EoIP…it just uses an TCP port to setup so client side can be behind a NAT.
One important artifact of enabling IPSec on EoIP directly, is IKEv2 NAT traversal will be used for the outer IPSec tunnel. Without IPSec, EoIP’s GRE does need routable IP on BOTH sides. But with IPSec-enabled, only one side needs a static/routable IP.
Agree on /ip cloud , /user group however I think /ip firewall filter is required as the question is about network traffic not passing through EOIP tunnels
I see where you’re going with and it make sense. What I didn’t tell in the costraints of the setup is that I will have Computer C, D etc over MT 4, 5 etc which will be connected to MT2. Computer A will have to connect to only one Computer B, C etc at a time.
What you say makes perfect sense however I discovered that NAT traversal (required by IPsec behind NAT) doesn’t work at all in mobile phone hotspots or in LTE dongle which may act as Internet gateways for MT1 and MT2
