Hello,
Is there possible to configure Mikrotik routers, what are connected through public internet by IPSEC, that all computers can view active
computers both networks
thanks
Yes.
I do it all day long…
I have 3 remote sites all connecting to a central NOC.
I use IPSEC and firewall rules to create virtual tunnels.
All 3 remote sites can “see the NOC” and the NOC can see all three sites.
All 3 remote sites CAN NOT see each other. (by design)…
( I had help with the desigh… )
Drop me a line and I will turn you on the the person who set it up.
I wont give away his configuration… He has to eat too…
Craig
First of all: read Mikrotik manual and try to use examples, described here. IPSec setup is simple and straightforward but requires some basic networking knowledge.
It’s not really that hard to setup.. as written above just read the manual and you should get the tunnel “established”. Getting data through it might be another thing though!
Been bumping my head against this for quite some time (on my spare hours since it wasn’t critical) and finally found that if I have a src-nat out to Internet (masquerade to allow for surf etc) everything would be pumped into it, even traffic supposed to go through the Ipsec tunnels.
You HAVE to create a NAT rule to accept the tunneltraffic and place it before your src-nat out to Internet!
/ ip firewall nat
add chain=srcnat src-address=192.168.2.0/24 dst-address=200.21.23.0/24 action=accept comment=“IPSec tunnels” disabled=no
If you do not have this then a tracert of traffic destined for the remote site will show it going out in the Internet
So forget all you have learned about “tunnels” (namely pptp) before if you are doing Ipsec, pptp tunnels are a completely different thing since there you can define routes etc
Hope this helps
/Jörgen
Link to Mikrotik manual: http://www.mikrotik.com/docs/ros/2.9/ip/ipsec
Yes, sending VPN packets “unmodified” directly to public interface is little bit unusual, but it works 