VPN site-to-site routing host is unreachable even with connection between gateway

RouterOS General
1

Hi i have two MikroTik routers connected using IKEv2 VPN with certificates, the connection works, and is established, i can also ping one another’s vpn network address. Unfortunatly i have trouble to connect to the others LAN network on the opposite routers. (I need to create connection from 192.168.200.0/24 to 192.168.45.0/24)
Setup is:
Router A (Server):
VPN Peer Passive
VPN netwrok ip: 10.22.22.1
LAN netwrok 192.168.200.0/24
Routing 192.168.45.0/24 throu gateway 10.22.22.2

Router B (client):
VPN Peer not passive
VPN network ip: 10.22.22.2
LAN network: 192.168.45.0/24
Routing 192.168.20.0/24 throu gateway 10.22.22.2

I don’t think the problem is with firewall filters and raw as even with allowing all will not fix the issue, if anyone has any idea i would appreciate the help. (Also dont be weirded out by the public IPs i anonymised them)
RouterClient.txt (23.2 KB)
RouterServer.txt (33.1 KB)

2

Instead of creating a tunnel between the VPN addresses of the tunnel on client side, you could use a policy template. As for the communication between the LANs, it should be quite an easy fix:

# Server

/ip ipsec policy
add action=encrypt proposal=ike2-proposal src-address=192.168.200.0/24 dst-address=192.168.45.0/24

# Client

/ip ipsec policy
add action=encrypt proposal=IKEv2 dst-address=192.168.200.0/24 src-address=192.168.45.0/24

And delete the created routes because they’ll be overridden by the policies

3

Do you mean by that i should make this a template what you wrote ? because everytime i write it it changes its adrress, orshould it be a tunnel ? I have other VPN server running at same time, also sorry for maybe dumb questions but im still quite new to thee VPNs in mikrotik.

4

I meant that you could scratch the following policy on client side:

/ip ipsec policy
add dst-address=10.22.22.1/32 peer=ike2-peer proposal=IKEv2 src-address=10.22.22.2/32 tunnel=yes

And add a template in place of it:

/ip ipsec policy
add group=MyGroup peer=ike2-peer proposal=IKEv2 template=yes

After which you add the tunnel policy that connects the two LANs:

/ip ipsec policy
add action=encrypt proposal=IKEv2 dst-address=192.168.200.0/24 src-address=192.168.45.0/24

On server side you just add a tunnel policy:

/ip ipsec policy
add action=encrypt proposal=ike2-proposal src-address=192.168.200.0/24 dst-address=192.168.45.0/24
5

No need to be, IPsec on MikroTik and overall is a bit finicky

6

Unfortunatly the mikrotik for some reason is not routing it, its returning net unreachable. Should i also change the mode config ? (Tried different variants and still can’t do it, also tried again to open entire firewall if its wrong firewall conf but no)