sorry… I fixed this by using Router/48: from HE instead /64:
Version 6.44beta28 has been released.
Before an upgrade:
- Remember to make backup/export files before an upgrade and save them on another storage device;
- Make sure the device will not lose power during upgrade process;
- Device has enough free storage space for all RouterOS packages to be downloaded.
What's new in 6.44beta28 (2018-Oct-29 07:58):
MAJOR CHANGES IN v6.44:
!) cloud - added command "/system backup cloud" for backup storing on cloud (CLI only);
!) upgrade - release channels renamed - "bugfix" to "long-term", "current" to "stable" and "release candidate" to "testing";
!) upgrade - "testing" release channel now can contain "beta" together with "release-candidate" versions;
Changes in this release:
!) radius - initial implementation of RadSec (Radius communication over TLS);
*) bridge - added option to monitor fast-forward status;
*) bridge - disable fast-forward when using SlowPath features;
*) bridge - fixed DHCP Option 82 parsing when using DHCP Snooping;
*) certificate - fixed time zone adjustment for SCEP requests;
*) crs328 - fixed SFP+ interface linking on CRS328-24P-4S+RM (introduced in v6.44beta17);
*) crs328 - fixed SFP ports not reporting auto-negotiation status;
*) crs328 - improved link status update on disabled SFP and SFP+ interfaces;
*) defconf - automatically accept default configuration if reset done by holding button;
*) defconf - fixed configuration not generating properly on upgrade;
*) ethernet - fixed linking issues on wAP ac, RB750Gr2 and Metal 52 ac (introduced in v6.43rc52);
*) fetch - fixed fetching with "as-value" creating an empty file (introduced in v6.44beta20);
*) fetch - fixed "without-paging" option;
*) health - fixed bad voltage readings on RB493G;
*) ike2 - added option to specify certificate chain;
*) ike2 - send split networks over DHCP (option 249) to Windows initiators if DHCP Inform is received;
*) ike2 - show weak pre-shared-key warning;
*) ipsec - added basic pre-shared-key strength checks;
*) ipsec - fixed hw-aead (H) flag presence under Installed SAs on startup;
*) ipsec - improved stability when uninstalling multiple SAs at once;
*) ipsec - made peers autosort themselves based on reachability status;
*) ipsec - properly update warnings under peer menu;
*) lte - added support for JioFi JMR1040 modem;
*) lte - fixed IPv6 activation for R11e-LTE-US modems;
*) lte - fixed LTE interface not working properly after reboot on RBSXTLTE3-7;
*) lte - fixed missing running (R) flag for Jaton LTE modems;
*) ospf - improved stability while handling type-5 LSAs;
*) port - improved "remote-serial" TCP performance in RAW mode;
*) rb3011 - implemented multiple engine IPsec hardware acceleration support;
*) rbm33g - improved stability when used with some USB devices;
*) routerboard - require at least 10 second interval between "reformat-hold-button" and "max-reformat-hold-button";
*) routerboard - show "boot-os" and "force-backup-booter" option only on devices that have such feature;
*) snmp - added "dot1qPortVlanTable" and "dot1dBasePortTable" OIDs;
*) ssh - added error log message when key exchange fails;
*) ssh - fixed non-interactive shell not returning all output (introduced in v6.44);
*) tr069-client - fixed HTTP cookie getting duplicated with the same key;
*) tunnel - made "ipsec-secret" parameter sensitive;
*) upgrade - made security package depend on DHCP package;
*) wireless - removed G/N support for 2484MHz in "japan" regulatory domain;
*) w60g - fixed scan in bridge mode;
*) w60g - improved PtMP performance;
*) w60g - renamed "frequency-list" to "scan-list";
*) w60g - renamed disconnection message when license level did not allow more connected clients;
*) w60g - added align mode "/interface w60g align" (CLI only);
If you experience version related issues, then please send supout file from your router to support@mikrotik.com. File must be generated while router is not working as expected or after crash.
Starting with 6.44beta28 the security package requires the dhcp package to be installed? I think that is something to be noted in changelog. What’s the reason?
Nice catch. It is because of the new IKEv2 feature which works with DHCP. I will update the changelog.
ike2 - send split networks over DHCP (option 249) to Windows initiators if DHCP Inform is received;
Any Examples?
If I am not mistanken this means that split tunneling will now work!
There is no special configuration needed. RouterOS will automatically convert split-network parameter to use with DHCP option.
I just installed beta28 on brand new HapLite (default Settings).
added Certificates and ipsec ike2 RSA setup:
/certificate
add common-name=TESTCA name=TESTCA days-valid=3650
sign TESTCA ca-crl-host=192.168.3.124
add common-name=192.168.3.124 subject-alt-name=DNS:192.168.3.124 key-usage=tls-server name=TestVPN days-valid=3600
sign TestVPN ca=TESTCA
add common-name=hunter key-usage=tls-client name=hunter days-valid=3600
sign hunter ca=TESTCA
/ip pool
add name=VPN-Pool ranges=192.168.222.100-192.168.222.150
/ip ipsec mode-config
add address-pool=VPN-Pool address-prefix-length=32 name=RW-cfg split-include=192.168.88.0/24
/ip ipsec peer profile
set [ find default=yes ] enc-algorithm=aes-128
/ip ipsec policy group
add name=RoadWarrior
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc
add auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc,aes-128-cbc name=proposal1 pfs-group=none
/ip ipsec peer
add auth-method=rsa-signature certificate=TestVPN exchange-mode=ike2 generate-policy=port-strict mode-config=RW-cfg passive=yes policy-template-group=RoadWarrior
/ip ipsec policy
add comment=IKEv2 dst-address=192.168.222.0/24 group=RoadWarrior proposal=proposal1 src-address=0.0.0.0/0 template=yes
Win10 client connects OK but split-include does not work. The Win10 1803 client does not get routes..
Also tried address-prefix-length=24.. still noting.
In log I can see mikrotik detect Windows Machine but split-include is not pushed to the client..
I have attached the ipsec debug log. Connect and disconnect from win10 test machine
@emils: Am I doing something wrong? Please advise.. thx
log.0.txt (53.4 KB)
I’m not Emils, however can you try to run packet sniffer before clicking “connect” on the Windows machine with the following settings (assuming that etherX is the name of the interface through which it connects)?
/tool sniffer set only-headers=no memory-limit=100 memory-scroll=yes file-name=“” file-limit=8000 streaming-enabled=no filter-stream=no filter-interface=etherX filter-mac-address=“” filter-mac-protocol=“” filter-ip-address=“” filter-ipv6-address=“” filter-ip-protocol=udp filter-port=53 filter-cpu=“” filter-direction=any filter-operator-between-entries=and
Then, do the following:
/tool sniffer start
/tool sniffer packet print interval=1s
And then start the client on Windows.
If you see a packet in the list, chances are high that it is the DHCPINFORM which is needed for the feature to work; however, another necessary condition may be to have more than one split-subnet, as one destination subnet is normally a mandatory part of the mode-config so there is no point in sending it using DHCP.
I tried with ether1 (my wan on test router)
but nothing is catcing in the sniffer when I connect or disconnect.
I dont really understand what DNS (udp/53) has to do with DHCP (udp/67-68)
If I change it to correct ports I get:
0 14.46 ether1 192.168.222.146:68 (bootpc) 255.255.255.255:67 (bootps) udp 342 0 no
1 19.212 ether1 192.168.222.146:68 (bootpc) 255.255.255.255:67 (bootps) udp 342 0 no
2 24.21 ether1 192.168.222.146:68 (bootpc) 255.255.255.255:67 (bootps) udp 342 0 no
I have also tried multiple subnets in split-include.. With no luck.
If I set user remote gateway on Win10 Client VPN connecton works.. But for all networks (split-include set 0.0.0.0/0, havent tried with includes…).
I’m a bit sleepy so I’ve mixed them up, that’s all. Good you’ve found out yourself.
Now if 192.168.222.146 is the address from the /ip pool assigned to /ip ipsec mode-config, so it is the one assigned to the Win PC using mode-config, you can double-check that it is a DHCPINFORM packet by sniffing into file and opening the file using Wireshark (update: just checked it myself on a W2012 system connected to 6.43.2, so yes, it is a DHCPINFORM)
So until Emils comes tomorrow, I’d try to attach a DHCP server to ether1, and that’s my last idea given that he’s already stated that the ipsec plant itself takes care about converting the split-include data into Option 249.
I dont get any DHCPInform..
Attached is the wireshark and then connect to VPN..
I cant put DHCP Server on WAN port …
guess we will wait for Mktik guys to wake up 
Night all and thnx for tips and help sindy!
wireshark.zip (15.5 KB)
You most likely do get the DHCPINFORM But to see it, you cannot capture on the PC as you did, you have to use /tool sniffer on Mikrotik and set file-name=something.pcap. When you capture on the PC, the DHCPINFORM is only seen there encrypted in the ESP so you cannot recognize it. The Mikrotik sniffer shows you both the IPsec transport packets (ESP in this case) and the plaintext packets extracted from them. This is not true in the opposite direction, i.e. you cannot see plaintext packets before they got encrypted on the same interface through which they are sent out encrypted.
OK my bad
Here is the Wireshark capture from Mikrotik..
There are DHCP Inform messages but I am not able to interpret them 
wireshark.zip (663 Bytes)
That is interesting. Are there really no other logs in ipsec topic after the IPsec-SA has been established? From what I can tell, DHCP inform is received on the router, but IPsec does not see the packet. What other configuration do you have on the router? Is there a DHCP server or client configured? Do you see any logs in dhcp topic when establishing the tunnel?
I have default configuration (eth1 → DHCLient to my private network)
All drop rules disabled
DHCPServer on Bridge (Default with IP pool 192.168.88.0)
VPN Pool is 192.168.222.0/24
I have attached the full config export compact
VPNTest.rsc (4.72 KB)
Weird, it works for me with exact your configuration and 1803 (Pro). Did you change any of the advanced ipv4 configuration on Windows side except for disabling EAP authentication? Note that it might take a few seconds for routes to be installed. How are you checking the route presence? Can you do ‘route print -4’ in cmd.exe? If that does not yield any results, please enable IPsec debug logs (topics=ipsec) and generate a supout.rif file after a few seconds when connection is established and send it to support@mikrotik.com.
I check exactly like that..
but there arent any routes from split-include..
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.3.1 192.168.3.122 55
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.3.0 255.255.255.0 On-link 192.168.3.122 311
192.168.3.122 255.255.255.255 On-link 192.168.3.122 311
192.168.3.124 255.255.255.255 On-link 192.168.3.122 56
192.168.3.255 255.255.255.255 On-link 192.168.3.122 311
192.168.222.0 255.255.255.0 On-link 192.168.222.148 46
192.168.222.148 255.255.255.255 On-link 192.168.222.148 301
192.168.222.255 255.255.255.255 On-link 192.168.222.148 301
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.3.122 311
224.0.0.0 240.0.0.0 On-link 192.168.222.148 301
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.3.122 311
255.255.255.255 255.255.255.255 On-link 192.168.222.148 301
===========================================================================
Suppout.rif sent to support..
If anyone else can try it would be super..
Maybe just my Win10 machine wont work as it should
I will test in the eventing with another..
Why can’t device-specific stuff like MAC-addresses simply be removed from the backup files?
Proposal: choice, to omit not on backup but on restore. So you will have allways a full backup and can select on restore if certain values should not be restored.
Workings could be, enter the password if needed, that you can selected direct restore or making a selection containing options, which by omitting them not lead to bricking the device.
After deselecting data not to be restored a new backup file is written (with a different name), not containing the omitted data. This file is used for the restore and deleted after restoring, so one time usage.
The original full backup file will be untouched.
Let’s imagine the internals of this restoration process. There’s a database table with the list of interfaces, their parameters, their MAC addresses, etc. Now you restore it from backup leaving MAC address fields empty (?). So there’s no connection between entries in the table and real interfaces. Configuration is in inconsistent state.
Don’t think about backup like about an /export file. It’s a bit different and more low-level thing.
It will be greate to add this feature for PPP tunels too (SSTP, L2TP). Now I’m using forwarding DHCP Info packets to external DHCP server for DHCP option 249 (and another DHCP options for Windows clients).