Hello I have a problem that I need a help with.
I have 2 Mikrotik routers connected together through IPSEC.
Tunnel is up and I can access devices on network. But I have trouble accessing Web interface. The login page loads without problems but immediately when I fill username and password and try to log int I'm getting timeouts.
Can anyone suggest where could be a problem ? I've already tried to add fw rules to accept any traffic between sites but it did not work.
Probably, MTU problem
This fundamentally works (I use it regularly to manage a device behind a NAT running 7.22.3 and 7.22.1).
The one thing I noted was I needed to put the ipsec policies in to both the forward as well as the input chains in the firewall, or would only get connected devices, and not the remote router.
Also, do you have the srcnat entry for ipsec in place on the remote, as well as the ipsec preroute entry in raw?
It sounds as if a firewall rule is dropping the traffic as soon as it gets established.
Does ssh to the remote work across the tunnel?
(Never had to touch MTU, fwiw . . . )
Hello, thanks for the reply.
No I don't have any NAT rules for the IPSEC and I don't think it would be a NAT issue since other devices like NAS that is on 192.168.0.2 IP loads webpage and I can log in without problem.
Only problem is with router itself. Ping to router IP 192.168.0.1 works and I see it in the firewall connections (on the destination router). But telnet to either 443 or 22 times out and I don't see it in fw connections.
Hello, thanks for the reply I've also googled it could be an MTU issue but I can't find the interface for the IPSEC where the MTU could be modified.
It's srcnat and raw (lets ipsec preroute), and that was pretty much what I got when I didn't have them. Note that traffic to the router itself and traffic through the rounter are NOT subject to the same rules, and WebFig and ssh are about the only thing where you connect to the router. It's not really setting up a nat, but rather a rule . . .
I used this vid as a reference to set mine up and it got me past this. Details at about 22:00 . . .
https://www.youtube.com/watch?v=uVag_e475zc
Hello, unfortunately this did not help. I've set up "NAT" as shown in video but no change. Everything else works except web for mikrotiks. Telnet to 443 or 22 still times out.
You set both the rule in NAT and the rule in RAW, using your addresses, on both ends? Odd . . . that was the silver bullet for me. The initial connection was made, and then it switched to the rules foe "established" and died, which this circumvents. To further test, you can try disabling the deny rules and see if your issue persists. You might also look at firewall stats (and/or enable logging) to see what is eating your traffic.
It can be useful if you post your config here. It can be related with MTU or maybe with fasttrack. You can try to add a firewall raw rule to not track ipsec connections.
Hello so I managed to get the whole thing working. And you were right with the NAT. To summarize the final soloution was combination of:
FW rule with chain input
NAT rule for IPSEC networks
In my case the routers seem to got stuick in weird state to which point the whole IPSEC stopped working but after reboot everything started to work. Thanks a lot.
Yeah, it a goofy one . . . Since ipsec doesn't have an "interface", you can't assign it to LAN or WAN so kind of need to duplicate/hotwire a lot of the firewall stuff . . .
In any case, glad I could help!
(Oh, and on the ipsec hang, I recall that a disable/enable on (I think) the policy would get that back as well . . . )