Community discussions

MikroTik App
  4. RouterOS
  5. Beginner Basics

No access via ipsec from WAN

Locked
 
Spartacus
Member Candidate
Member Candidate
Topic Author
Posts: 132
Joined: Thu Apr 19, 2018 6:38 pm

No access via ipsec from WAN

Thu Jun 14, 2018 7:10 pm

Hi,
I am struggling with VPN Access over IPsec to my internal network.
I can connect to the router, but I cannot access anything in my local network (no website, ping does not work, etc.)
Connection is established.

I guess there is an issue with my FW rules, but I do not have a clue what is missing. On the other hand I am not sure if the ipsec policy is correct!
Maybe someone can check and help me to find the issue.

Prerequisites
  • Router RB 3011
  • Client: android phone
  • Network: 172.16.1.0/24 (part of AdminSubnet)
  • SSL Client-Certificate
  • SSL Server-Certificate

IPsec-Setup
Code: Select all
/ip pool add name=pool_VPN ranges=172.16.1.20-172.16.1.30
/ip ipsec mode-config add address-pool=pool_VPN address-prefix-length=32 name=vpn split-include=172.16.1.0 system-dns=no
/ip ipsec peer add address=0.0.0.0/0 auth-method=rsa-signature certificate=server dh-group=modp2048 enc-algorithm=aes-256 exchange-mode=ike2 generate-policy=port-strict hash-algorithm=sha256 mode-config=vpn passive=yes
/ip ipsec proposal set [ find default=yes ] auth-algorithms=sha256 pfs-group=none enc-algorithms=aes-256-cbc
/ip ipsec policy set 0 dst-address=172.16.1.0/24 src-address=172.16.1.0/24
Input Chain
Code: Select all
/ip firewall filter add chain=input connection-state=established,related comment="accept established,related" action=accept 
/ip firewall filter add chain=input connection-state=invalid comment="drop invalid" action=drop
/ip firewall filter add chain=input in-interface-list=LAN src-address-list=AdminSubnet action=accept
/ip firewall filter add chain=input dst-port=500,4500 in-interface-list=WAN protocol=udp comment="VPN: allow udp 500 and 4500" action=accept 
/ip firewall filter add chain=input in-interface-list=WAN protocol=ipsec-esp comment="VPN: allow ESP" action=accept
 /ip firewall filter add chain=input in-interface-list=LAN protocol tcp dst-port 53 comment="Allow LAN DNS queries-TCP" action=accept
/ip firewall filter add chain=input in-interface-list=LAN protocol udp dst-port 53 comment="Allow LAN DNS queries-UDP" action=accept
/ip firewall filter add chain=input comment="drop everything" action=drop
# EOF Input Chain
NAT
Code: Select all
/ip firewall nat add chain=dstnat dst-port=53 protocol=tcp comment= "Force Users to Router for DNS - TCP" action=redirect
/ip firewall nat add chain=dstnat dst-port=53 protocol=udp comment= "Force Users to Router for DNS - UDP" action=redirect
/ip firewall nat add chain=srcnat out-interface-list=WAN comment= "masquerade LAN->WAN" action=masquerade
# EOF NAT

There is actually no "ipsec-related" rule in forward chain, maybe this is needed for LAN-Access via ipsec, I am not sure!

Thanks,
Christian
Top
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19325
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:
Contact anav

Re: No access via ipsec from WAN

Thu Jun 14, 2018 8:44 pm

I note that in the default rules when I first access my hex, the following two rules are in the forward filter chain

add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
Top
 
Spartacus
Member Candidate
Member Candidate
Topic Author
Posts: 132
Joined: Thu Apr 19, 2018 6:38 pm

Re: No access via ipsec from WAN

Thu Jun 14, 2018 11:00 pm

Hi all
I checked anavs proposal, but it does not work. Same situation as before!

Christian
Top
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:
Contact CZFan

Re: No access via ipsec from WAN

Fri Jun 15, 2018 12:43 pm

Did not study OP in detail, but what I have quickly picked up and if my understanding is correct, I will change the following:

Give roadwarriors a seperate subnet to internal, i.e. 172.16.2.20 - 172.16.2.30.
You also seemed to have missed specifying subnet mask in your ipsec mode-config rule, so below is what it will look like after changes proposed:

/ip pool add name=pool_VPN ranges=172.16.2.20 - 172.16.2.30
/ip ipsec mode-config add address-pool=pool_VPN address-prefix-length=32 name=vpn split-include=172.16.2.0/24 system-dns=no
/ip ipsec policy set 0 dst-address=172.16.2.0/24 src-address=172.16.1.0/24
Top
 
Spartacus
Member Candidate
Member Candidate
Topic Author
Posts: 132
Joined: Thu Apr 19, 2018 6:38 pm

Re: No access via ipsec from WAN

Tue Jun 19, 2018 10:04 am

Hi,
sorry for the late response. I checked the changes from CZFan but now I will get an error in the log file (no policy found) and connection is not established.

Changes:
Code: Select all
/ip pool add name=pool_VPN ranges=172.16.2.20 - 172.16.2.30
/ip ipsec mode-config add address-pool=pool_VPN address-prefix-length=32 name=vpn split-include=172.16.2.0/24 system-dns=no
/ip ipsec policy set 0 dst-address=172.16.2.0/24 src-address=172.16.1.0/24
Does anyone has a clue what is missing now?

Christian
Top
 
Spartacus
Member Candidate
Member Candidate
Topic Author
Posts: 132
Joined: Thu Apr 19, 2018 6:38 pm

Re: No access via ipsec from WAN

Tue Jun 19, 2018 10:47 am

Hi,
ok, I have it! :-)
On split-include you must define the networks that the client can access. And this is 172.16.1.0/24 and not 172.16.2.0/24
Code: Select all
/ip pool add name=pool_VPN ranges=172.16.2.20 - 172.16.2.30
/ip ipsec mode-config add address-pool=pool_VPN address-prefix-length=32 name=vpn split-include=172.16.1.0/24 system-dns=no
/ip ipsec policy set 0 dst-address=172.16.2.0/24 src-address=172.16.1.0/24
The only thing, which is not working, is the access to other Subnets (192.168.1.0/24) and I do not understand, where I have to configure this feature.

Christian
Top
 
Spartacus
Member Candidate
Member Candidate
Topic Author
Posts: 132
Joined: Thu Apr 19, 2018 6:38 pm

Re: No access via ipsec from WAN

Tue Jun 19, 2018 11:59 pm

Hi,
I am still struggling with the config. I´ve added ana dditional subnet to the config, but it does not work. Does anybody knows what is going wrong here?.
Code: Select all
/ip ipsec mode-config add address-pool=pool_VPN address-prefix-length=32 name=vpn split-include=172.16.1.0/24,192.168.1.0/24 system-dns=no
Christian
Top
 
Spartacus
Member Candidate
Member Candidate
Topic Author
Posts: 132
Joined: Thu Apr 19, 2018 6:38 pm

Re: No access via ipsec from WAN

Wed Jun 20, 2018 11:40 pm

Hi,
can noone help here?
Christian
Top
Locked

Who is online

Users browsing this forum: ShindigNZ and 71 guests
  4. RouterOS
  5. Beginner Basics