Hi, How can I access my VPN on the other side. I have a tight L2TP IPSEC addressing 172.31.0.1 on one side and 172.20.20.1 on the other. Now I would like to get from the 192.168.0.0 network to 172.20.20.1. How can I do this?
On the 172.20.20.1 side, you have to add a route to 192.168.0.0/x. If that side is the client, it can be a static route with 172.31.0.1 or the L2TP interface name as gateway. If that side is the server, the best approach is to set the routes item on the /ppp secret row representing the client.
but this is not ppp but site to site. What in this case is the client if it is a site to site connection?
If it has configuration in “/interface l2tp-client”, it’s client, and when it’s in “/interface l2tp-server”, it’s server. But it’s obvious, isn’t it?
I have a configuration in IP> IPSEC and not “/ interface l2tp-client” and “/ interface l2tp-server”,
In that case, remove L2TP from the topic title 
To get any useful advice, post an anonymized export of your current configuration of both routers.
/interface bridge
add ingress-filtering=no mtu=1518 name=bridge1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] mtu=1492
set [ find default-name=ether4 ] mtu=1518
set [ find default-name=sfp1 ] auto-negotiation=no disabled=yes mtu=1596 rx-flow-control=on tx-flow-control=on
/interface vlan
add interface=bridge1 mtu=1518 name=Dom vlan-id=2
add interface=bridge1 mtu=1518 name=MGMT vlan-id=999
add interface=bridge1 mtu=1518 name=Serwery vlan-id=10
add interface=bridge1 mtu=1518 name=Storage vlan-id=21
add interface=bridge1 name=VPN_STS vlan-id=500
add interface=bridge1 mtu=1518 name=VPN_STS_NETWORK vlan-id=502
add interface=ether5 name=WAN-VLAN vlan-id=200
add interface=bridge1 mtu=1518 name=Wiktor vlan-id=4
add interface=bridge1 mtu=1518 name=Wirtualizator-Prox vlan-id=20
/interface pppoe-client
add add-default-route=yes dial-on-demand=yes disabled=no interface=WAN-VLAN max-mru=1500 max-mtu=1500 name=pppoe-out1 user=
/disk
set sd1 disabled=no
set sd1-part1 disabled=no name=disk1
/interface list
add name=WAN
add name=LAN
add name=FT
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec policy group
add name=Francja_g1
add name=Polska_VPS_G1
/ip ipsec profile
add dh-group=modp2048 enc-algorithm=aes-256,3des hash-algorithm=sha256 name=VPN_f1
/ip ipsec peer
add address=adddress/32 disabled=yes exchange-mode=ike2 local-address=adddress name=Polska_VPN_P1 port=500 profile=VPN_f1
add address=adddress/32 disabled=yes exchange-mode=ike2 name=Francja_peer1 port=500 profile=VPN_f1
/ip ipsec proposal
add enc-algorithms=aes-128-cbc name=Francja_p2
add enc-algorithms=aes-128-cbc lifetime=15m name=Polska_VPS_p2
/ip pool
add name=dhcp_pool1 ranges=192.168.0.100-192.168.0.200
add name=Lab ranges=192.168.1.2-192.168.1.254
add name=VPN ranges=192.168.2.2-192.168.2.254
add name=IPSEC_VPN ranges=172.16.2.2-172.16.2.5
/ip dhcp-server
add address-pool=dhcp_pool1 interface=Dom lease-time=2h name=dhcp1
/port
set 0 name=serial0
/ppp profile
add bridge=bridge1 dns-server=192.168.2.1 local-address=192.168.2.1 name=adam remote-address=VPN use-encryption=required
add change-tcp-mss=yes dns-server=172.16.2.1 local-address=172.16.2.1 name=IPSEC_VPN_PROFILE remote-address=IPSEC_VPN use-encryption=yes
/queue simple
add dst=pppoe-out1 max-limit=7M/25M name=Szymon target=192.168.0.196/32 time=6h-22h,sun,mon,tue,wed,thu,fri,sat
add dst=pppoe-out1 max-limit=7M/25M name=Mariusz target=192.168.0.214/32 time=6h-22h,sun,mon,tue,wed,thu,fri,sat
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
add disabled=no name=default-v3 version=3
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
add disabled=yes instance=default-v3 name=backbone-v3
/user group
set full policy=local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,password,web,sniff,sensitive,api,romon,dude,rest-api
/interface bridge port
add bridge=bridge1 ingress-filtering=no interface=Dom pvid=2
add bridge=bridge1 ingress-filtering=no interface=MGMT pvid=999
add bridge=bridge1 ingress-filtering=no interface=Serwery pvid=10
add bridge=bridge1 hw=no ingress-filtering=no interface=ether4 pvid=999
add bridge=bridge1 ingress-filtering=no interface=Wiktor pvid=4
add bridge=bridge1 interface=Wirtualizator-Prox pvid=20
add bridge=bridge1 interface=Storage pvid=21
add bridge=bridge1 interface=VPN_STS pvid=500
add bridge=bridge1 interface=VPN_STS_NETWORK pvid=502
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/ipv6 settings
set max-neighbor-entries=8192
/interface bridge vlan
add bridge=bridge1 tagged=ether4,bridge1,MGMT vlan-ids=999
add bridge=bridge1 tagged=bridge1,ether4 untagged=Dom vlan-ids=2
add bridge=bridge1 tagged=bridge1,ether4 untagged=Serwery vlan-ids=10
add bridge=bridge1 tagged=ether4,bridge1 vlan-ids=4
add bridge=bridge1 tagged=bridge1,ether4 untagged=Wirtualizator-Prox vlan-ids=20
add bridge=bridge1 tagged=bridge1,ether4,Storage vlan-ids=21
add bridge=bridge1 tagged=ether4,bridge1 untagged=VPN_STS vlan-ids=500
add bridge=bridge1 tagged=bridge1,ether4 untagged=VPN_STS_NETWORK vlan-ids=502
/interface l2tp-server server
set authentication=mschap2 default-profile=IPSEC_VPN_PROFILE enabled=yes max-sessions=1 use-ipsec=yes
/interface list member
add interface=ether5 list=WAN
add interface=ether4 list=LAN
add interface=Storage list=FT
add interface=Wirtualizator-Prox list=FT
/interface sstp-server server
set authentication=mschap2 default-profile=IPSEC_VPN_PROFILE
/ip address
add address=192.168.0.1/24 interface=Dom network=192.168.0.0
add address=10.70.1.1/29 interface=Wiktor network=10.70.1.0
add address=172.16.1.1/24 interface=MGMT network=172.16.1.0
add address=10.60.1.1/24 interface=Serwery network=10.60.1.0
add address=10.10.10.1/25 interface=Wirtualizator-Prox network=10.10.10.0
add address=10.10.10.129/25 interface=Storage network=10.10.10.128
add address=172.31.0.1/30 interface=VPN_STS network=172.31.0.0
add address=10.90.0.1/29 interface=VPN_STS_NETWORK network=10.90.0.0
/ip dhcp-server lease
add address=192.168.0.6 mac-address=00:D8:61:78:B2:34 use-src-mac=yes
add address=192.168.0.5 mac-address=00:D8:61:78:B2:35 use-src-mac=yes
add address=192.168.0.214 comment=Mariusz mac-address=B4:2E:99:67:A7:EB use-src-mac=yes
add address=192.168.0.196 comment=Szymon mac-address=4C:CC:6A:AF:11:51 use-src-mac=yes
add address=192.168.1.250 client-id=1:e0:db:55:c4:4c:b mac-address=E0:DB:55:C4:4C:0B server=*4 use-src-mac=yes
add address=192.168.0.7 client-id=1:0:21:b7:39:dc:9e mac-address=00:21:B7:39:DC:9E server=dhcp1 use-src-mac=yes
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=1.1.1.1,1.0.0.1 gateway=192.168.0.1
add address=192.168.1.0/24 dns-server=1.1.1.1,1.0.0.1 gateway=192.168.1.1
/ip dns
set servers=1.1.1.1,1.0.0.1
/ip firewall address-list
add address=192.168.0.0/24 list=Adresy_calej_sieci
add address=192.168.0.196 list=Komp
add address=192.168.0.214 list=Komp
add list=ddos-attackers
add list=ddos-target
add address=192.168.0.196 list=Bracia
add address=192.168.0.214 list=Bracia
/ip firewall filter
add action=accept chain=input src-address=172.20.20.0/30
add action=accept chain=output dst-address=172.20.20.1
add action=accept chain=input src-address=192.168.2.0/24
add action=accept chain=forward src-address=192.168.2.0/24
add action=accept chain=input dst-port=500,1701,4500 protocol=udp
add action=accept chain=input dst-port=23119 protocol=tcp
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddos-target address-list-timeout=10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddos-attackers address-list-timeout=10m chain=detect-ddos
add action=drop chain=input dst-port=8291 in-interface=pppoe-out1 protocol=tcp
add action=drop chain=input in-interface=pppoe-out1 protocol=icmp
add action=add-src-to-address-list address-list=Syn_Flooder address-list-timeout=30m chain=input comment="Add Syn Flood IP to the list" \
connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner address-list-timeout=1w chain=input comment="Port Scanner Detect" protocol=tcp psd=\
21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" src-address-list=Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=ICMP protocol=icmp
add action=jump chain=forward comment="Jump for icmp forward flow" jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=bogons
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" connection-state=established
add action=accept chain=input comment="Accept to related connections" connection-state=related
add action=accept chain=input comment="Full access to SUPPORT address list" src-address-list=support
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood, adjust the limit as needed" icmp-options=8:0 limit=2,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP protocol=icmp
add action=fasttrack-connection chain=forward connection-state=established,related dst-address-list=!Bracia hw-offload=yes protocol=!icmp \
src-address-list=!Bracia
add action=accept chain=forward connection-state=established,related dst-address-list=!Bracia protocol=!icmp src-address-list=!Bracia
/ip firewall mangle
add action=log chain=output dst-address=172.20.20.1
add action=accept chain=prerouting
/ip firewall nat
add action=accept chain=srcnat dst-address=172.20.20.1 log=yes src-address=192.168.0.0/24 to-addresses=0.0.0.0/0
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat dst-address=10.60.1.6 dst-address-type=local dst-port=80 protocol=tcp to-addresses=10.60.1.6 to-ports=80
add action=dst-nat chain=dstnat dst-address=10.60.1.6 dst-address-type=local dst-port=443 protocol=tcp to-addresses=10.60.1.6 to-ports=443
/ip firewall raw
add action=drop chain=prerouting dst-address-list=ddos-target src-address-list=ddos-attackers
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
/ip ipsec identity
add generate-policy=port-strict notrack-chain=prerouting peer=Francja_peer1 policy-template-group=Francja_g1
add generate-policy=port-strict notrack-chain=prerouting peer=Polska_VPN_P1 policy-template-group=Polska_VPS_G1
/ip ipsec policy
add dst-address=172.31.0.2/32 level=unique peer=Francja_peer1 proposal=Francja_p2 src-address=172.31.0.1/32 tunnel=yes
add dst-address=172.20.20.1/32 level=unique peer=Polska_VPN_P1 proposal=Polska_VPS_p2 src-address=172.31.0.1/32 tunnel=yes
/ip route
add disabled=no distance=2 dst-address=172.16.2.0/24 gateway=Dom pref-src=0.0.0.0 routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=10.80.0.0/24 gateway= pref-src=0.0.0.0 routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=172.20.20.0/24 gateway=VPN_STS pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes port=65408
set ftp disabled=yes port=960
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=client profile=adam service=ovpn
add disabled=yes name=l2tp-adam profile=IPSEC_VPN_PROFILE service=l2tp
add disabled=yes name=l2tp-wiktor service=l2tp
add name=praca profile=adam service=ovpn
add name=xVdJjNbbxt6wJLn4bxMg profile=IPSEC_VPN_PROFILE service=l2tp
/snmp
set enabled=yes location=192.168.0.20 trap-generators=interfaces trap-interfaces=all
/system clock
set time-zone-name=Europe/Warsaw
/tool bandwidth-server
set authenticate=no max-sessions=1000
the other side is debian, not mikrotik
Since you are using bare IPsec, you have to add, at both peers, a policy for each combination of local and remote subnet (or address) you want to be linked using IPsec.
So on the Tik side, it would be /ip ipsec policy add dst-address=172.20.20.1/32 level=unique peer=Polska_VPN_P1 proposal=Polska_VPS_p2 src-address=192.168.0.0/24 tunnel=yes ; on the Debian side, whatever is the proper policy configuration in the syntax of the *Swan you use there, with swapped “src” and “dst” roles of course.
What if I want to access 172.20.20.1 from all networks on my side (mikrotik)? Can this be solved somehow based on routing or something else?
You can use IPsec to encrypt a GRE or IPIP tunnel and use normal routing through that tunnel, or you can use a large subnet (like 192.168.0.0/16) in the policy - the best approach depends on your overall topology.
Is such a GRE or IPIP tunnel safe? Can I use it on debian? Do you have an article about it - how to use it?
The transport packets of the tunnel will be encrypted using IPsec so it will be as secure as bare IPsec.
On Debian, use man ip-link to learn how to set up this kind of tunnel. Use the addresses linked using the policy as transport ones for the tunnel so that the transport traffic was encrypted.
On Mikrotik, disable keepalive on the tunnel interface, as Linux will not forward the keepalive “responses”.
I recommend to use IPIP rather than GRE - first, it uses a smaller header, and second, Mikrotik firewall has started handling GRE in a weird way since a vulnerability fix had been introduced in 6.43.something.
Are you sure I can use the IPIP tunnel with Debian? I have nowhere found how to encrypt this tunnel on the Debian side with ipsec
I am sure that whatever traffic has source and destination address that match the traffic selector of an IPsec policy gets encrypted by IPsec and delivered to the peer to which that policy is bound to (unless the selector also specifies a particular IP protocol and port(s), which is not your case here). That’s why I’ve written that you must set the IP addresses for the transport packets to be the ones to which the policy refers.