VPN problem

RouterOS General
1

I am having a problem with Mikrotik routerboard using latest OS: 2.9.46

Recently our PPTP VPN stopped working. We have discovered that we cannot ping the WAN interface of the router from the LAN. There isn’t response.

Also, what we found is that when we run a trace route to the IP of the WAN interface, it will hop through that interface and attempt to continue routing.

I.E. if the WAN IP address is a.a.a.a:

tracert a.a.a.a

1 1 ms <1 ms 1ms a.a.a.a
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.


I can’t see anything in the configuration that may cause this issue.

Does anyone have any ideas? Do we need to downgrade the OS? Replace the routerboard??

I have attached supout.rif

2

You should check that the subnets are not matching in the NAT rule, if you are using NAT.

Regards.

Faton

3

I am not sure what you mean, which subnets could be matching?

I am using masquerade for dynamic source NAT. Other than, just dst-nat for port forwarding.

However, we tried disabling all NAT rules, and it did not resolve the issue.

4

sorry, my mistake I was thinking on IPSec not PPTP, I’ll come back to this issue.

Regards.

Faton

5

I do have an IPSEC tunnel that forwards through the NAT, but the Mikrotik is not handling that transaction. I don’t think that could cause the problem however, as we disabled the port/protocol forwarding for the IPSEC tunnel and it still did not resolve this issue.

6

Anyone have any ideas?

7

we could all guess all day long, but until you post your rules and routes you’re not going to get much from anyone.

Sam

8

Disabling any static routes and firewall rules does not resolve the issue.

All routes are dynamically created routes. WAN IP is gathered from DHCP and DHCP adds default route, dynamically.

WAN IP: a.a.a.a
WAN gateway: a.a.a.b
LAN IP: 192.168.1.1

Looks like this:

0.0.0.0/0 routes to a.a.a.b
a.a.a.0/24 has pref. source a.a.a.a
192.168.1.0/24 has pref. source 192.168.1.1

9

post your nat rules:

/ip firewall nat export

10

0 chain=srcnat action=masquerade out-interface=BtmEther3 src-address=192.168.1.0/24

11

U should verify rules at a.a.a.b. Next, all routers between 2 routers making vpn. Ping and traceroute between is necessary, but unfortunately not sufficient condition.
In one word, check all routers between: routing, firewall, etc. Ping and traceroute cannot disapear accidentally. Remember all changes in all routers. Also check “/ ip firewall service-port pr” pptp should be enabled.

I hope that helps.
Re,
C. G.

12

Thanks chvdr. I think the subject of my post is misleading. We discovered the problem when the VPN stopped working, but upon investigation the problem seems to be more far-reaching and the VPN issue is a side-effect.

I cannot ping the WAN side IP address from inside the LAN at all! Even if the router were not connect to any networks on the WAN side, I should still be able to ping the address.

13

or firewall stopped smt. I have never ping nothing when I do some vpn. It just run and works.
I can’t recommend you nothing else different.

Re,
C. G.

14

This issue is still unresolved. Anyone else have any thoughts here? I think I need to replace the Routerboard…

15

Better contact support before replacing anything. All the more that, I have never seen (or heart) about not propertly working Routerboard.

Best regards,
C. G.