VPN ipsec - no local LAN client access

I’ve installed Router OS CHR and setup an Ipsec vpn . I’m able to connect from remote client and I receive a correct IP address from DHCP server but I cannot access anything on my LAN except the router itself.

my configuration is :

 2024-12-28 14:19:43 by RouterOS 7.16.2
# software id = 
#
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no
set [ find default-name=ether2 ] advertise=\
    1G-baseT-full,1G-baseX,2.5G-baseT,2.5G-baseX disable-running-check=no
/interface l2tp-server
add name=l2tp-in1 user=VPN
/interface vlan
add interface=ether2 name="vlan Tim" vlan-id=835
/interface pppoe-client
add add-default-route=yes disabled=no interface="vlan Tim" name=pppoe-tim \
    use-peer-dns=yes user=aliceadsl
/interface list
add name=LAN
add name=WAN
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1
/ip pool
add name=dhcp_pool0 ranges=192.168.1.10-192.168.1.99
/ip dhcp-server
add address-pool=dhcp_pool0 interface=ether1 name=dhcp1
/ppp profile
set *FFFFFFFE local-address=192.168.1.1 remote-address=dhcp_pool0
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface l2tp-server server
set enabled=yes max-mtu=1280 use-ipsec=yes
/interface list member
add interface=ether1 list=LAN
add interface=pppoe-tim list=WAN
/ip address
add address=192.168.1.1/24 interface=ether1 network=192.168.1.0
/ip dhcp-server network
add address=192.168.1.0/24 domain=mikrotik gateway=192.168.1.1
/ip firewall filter
add action=accept chain=input comment="allow ICMP ping" protocol=icmp
add action=accept chain=input comment="Allow Web config" dst-port=80 protocol=\
    tcp src-address=192.168.1.0/24
add action=accept chain=input comment="allow Winbox" dst-port=8291 protocol=\
    tcp
add action=accept chain=input comment="allow SSH" dst-port=22 protocol=tcp \
    src-address=192.168.1.0/24
add action=accept chain=input comment="accept established connections" \
    connection-state=established
add action=accept chain=input comment="accept related connections" \
    connection-state=related
add action=accept chain=input comment="allow DNS for trusted network" \
    dst-port=53 protocol=udp src-address=192.168.1.0/24
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=accept chain=input dst-port=500,4500,1701 in-interface-list=WAN \
    protocol=udp
add action=drop chain=input comment="drop everything else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip firewall service-port
set ftp disabled=yes
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-128,3des hash-algorithm=\
    sha256
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=VPN profile=default-encryption service=l2tp
/system clock
set time-zone-name=Europe/Rome
/system note
set show-at-login=no
/system ups
add name=APC offline-time=4m port=*80000002
/tool graphing interface
add interface="vlan Tim" store-on-disk=no

Everything looks decent so will focus on firewall rules… Keep it simple… Also missing entirely any forward chain rules!!
EDIT: Also noted, nowhere do you assign a local IP address to the VPN**???**


One should keep rules in a proper order and for organization purposes and easy troubleshooting the chains together.
This is a big SECURITY infraction. Letting winbox open to the WWW!!!
add action=accept chain=input comment=“allow Winbox” dst-port=8291 protocol=tcp
Based on this will work a bit to give you a securer method

/ip firewall address-list { use dhcp static leases where applicable }
add address=192.168.1.X list=AUTHORIZED comment=“admin desktop”
add address=192.168.1.Y list=AUTHORIZED comment=“admin local device#2”
add address=vpn address list=AUTHORIZED comment=“remote admin vpn”
/ip firewall filter

{default rules to keep}
add action=accept chain=input comment=“accept established,related & untracked connections”
connection-state=established,related,untracked

add action=drop chain=input comment='“invalid traffic” connection-state=invalid
add action=accept chain=input comment=“allow ICMP ping” protocol=icmp

{admin rules}
add action=accept chain=input dst-port=500,4500,1701 in-interface-list=WAN protocol=udp
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=accept chain=input comment=“admin access” src-address-list=AUTHORIZED
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=udp
add action=accept chain=input comment=“users to services” in-interface-list=LAN dst-port=53 protocol=tcp
add action=drop chain=input comment=“drop everything else”

+++++++++++++++++++++++++++++
{ default rules to keep }
add action=accept chain=forward comment=“defconf: accept in ipsec policy” ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy” ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward comment=connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid

{ admin rules }
add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“VPN to LAN” src-address=VPN dst-address=192.168.1.0/24
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled-yes { enable or remove if not required }
add action=drop chain=forward comment=“Drop all else”

I’ve added the local IP address( 192.168.1.1) after exporting config

Ok, do you think should be safe if I’ll add the local IP range limitation ?

This is a CHR installation so no rules has been added as default. Should I add something else ? It seems I have what you wrote except ipsec

If CHR, you are probably safe removing firewall rules at least on the forward chain, I would keep all the input chain rules.
already provided the idea of only allowing Admin relate IP addresses to access the router for config purposes…
how you want to move forward is up to you. Just dont open up input chain to the WWW.

this is my actual config:

/ip firewall filter
add action=accept chain=input comment="allow ICMP ping" protocol=icmp
add action=accept chain=input comment="Allow Web config" dst-port=80 protocol=tcp src-address=192.168.1.0/24
add action=accept chain=input comment="allow web gui from VPN" dst-port=80 protocol=tcp src-address=192.168.2.0/24
add action=accept chain=input comment="allow Winbox" dst-port=8291 protocol=tcp src-address=192.168.1.0/24
add action=accept chain=input comment="allow SSH" dst-port=22 protocol=tcp src-address=192.168.1.0/24
add action=accept chain=input comment="Accept established, related, untracked connections" connection-state=established,related,untracked
add action=accept chain=input comment="allow DNS for trusted network" dst-port=53 protocol=udp src-address=192.168.1.0/24
add action=accept chain=input comment="Allow DNS from VPN lan " dst-port=53 protocol=udp src-address=192.168.2.0/24
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=accept chain=input dst-port=500,4500,1701 in-interface-list=WAN protocol=udp
add action=accept chain=forward comment="accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" ipsec-policy=out,ipsec
add action=drop chain=input comment="Drop invalid input" connection-state=invalid
add action=drop chain=forward comment="Drop invalid Forward" connection-state=invalid
add action=drop chain=input comment="Drop All not coming from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward connection-mark=!ipsec connection-state=established,related hw-offload=yes

perhaps it is more aggressive. I’m not able to establish a VPN from remote client

what have I done wrong ?

Is this CHR in a cloud somewhere or local to you???

False allarm !.. changed my Public IP…


I’ve another problem. I can ping all the LAN client from remote Vpn client except one. It is the Ap device. I don’t understand why … it is on the same lan.

found solution.

Firewall rule :

add action=accept chain=forward comment=“Allow LAN to VPN” dst-address=192.168.2.0/24 src-address=192.168.1.0/24
add action=accept chain=forward comment=“Allow VPN to LAN” dst-address=192.168.1.0/24 src-address=192.168.2.0/24