Community discussions

MikroTik App
 
altsvelu1988
just joined
Topic Author
Posts: 13
Joined: Wed Dec 17, 2014 5:30 pm
Location: Oman

GRE tunnel

Sat Jan 03, 2015 11:32 am

Hi.... I have created GRE tunnel between two routes over the internal Network (148.151.X.X/16) and the Tunnel has established successfully. R1 has the WAN link and its connected the internal network (148.151.234.X/27). R2 is connected (148.151.124.X/27). In R2 i can reach that R1 WAN link gateway but couldn't able to reach the internet. should i need to add any firewall rule to forward the traffic from R1 to R2...?
 
Arcee
Member Candidate
Member Candidate
Posts: 272
Joined: Fri Jun 27, 2014 2:33 pm

Re: GRE tunnel

Sat Jan 03, 2015 12:58 pm

Not sure if I understand what you are trying to accomplish.

If you're just trying to get out to the internet, sounds like you just need to masquerade traffic from R2.

Add this to R1:
/ip firewall nat
add action=masquerade chain=srcnat out-interface=[INSERT WAN INT NAME HERE]
 
altsvelu1988
just joined
Topic Author
Posts: 13
Joined: Wed Dec 17, 2014 5:30 pm
Location: Oman

Re: GRE tunnel

Sat Jan 03, 2015 1:42 pm

Yes i created that rule but still having same problem...
here my config....
R1
/interface gre
add keepalive=10 local-address=148.151.234.62 name=gre-tunnel1 remote-address=148.151.124.168
/ip address
add address=10.100.18.24/19 comment=WAN interface=wlan1 network=10.100.0.0
add address=148.151.234.62/27 comment=LAN interface=ether6 network=148.151.234.32
add address=192.168.2.1/32 comment=GRE interface=gre-tunnel1 network=192.168.2.2
/ip dns
set servers=212.72.23.4,212.72.1.186,82.178.158.173
/ip firewall nat
add action=masquerade chain=srcnat out-interface=wlan1
add action=masquerade chain=srcnat out-interface=ether6
add action=masquerade chain=srcnat out-interface=gre-tunnel1
/ip route
add distance=1 gateway=148.151.234.33
add distance=1 dst-address=0.0.0.0/32 gateway=10.100.0.1
add distance=1 dst-address=148.151.234.32/32 gateway=ether6

R2
/interface gre
add comment=GRE keepalive=10 local-address=148.151.124.168 name=gre-tunnel1 \
remote-address=148.151.234.62
add name=dhcp_pool1 ranges=192.168.3.2-192.168.3.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=wlan1 name=dhcp1
/ip address
add address=148.151.124.168/27 comment=LAN interface=vlan8 network=148.151.124.160
add address=192.168.2.2/32 comment=GRE interface=gre-tunnel1 network=192.168.2.1
add address=192.168.3.1/24 comment="LOCAL WIFI" interface=wlan1 network=192.168.3.0
/ip dhcp-relay
add dhcp-server=192.168.2.1 disabled=no interface=wlan1 local-address=10.100.31.1 name=relay1
/ip dhcp-server network
add address=192.168.3.0/24 gateway=192.168.3.1
/ip dns
set servers=212.72.23.4,212.72.1.186,82.178.158.173
/ip firewall mangle
add action=change-mss chain=forward in-interface=gre-tunnel1 new-mss=1436 protocol=tcp tcp-flags=syn tcp-mss=1437-65535
add action=change-mss chain=forward new-mss=1436 out-interface=gre-tunnel1 protocol=tcp tcp-flags=syn tcp-mss=1437-65535
/ip firewall nat
add action=masquerade chain=srcnat out-interface=vlan8
add action=masquerade chain=srcnat out-interface=gre-tunnel1
/ip route
add distance=1 gateway=192.168.2.1
add distance=1 dst-address=148.151.0.0/16 gateway=148.151.124.161
 
jkarras
Member Candidate
Member Candidate
Posts: 226
Joined: Fri Sep 06, 2013 3:07 am
Location: Utah, USA

Re: GRE tunnel

Sat Jan 03, 2015 11:53 pm

Couple of things I noticed.
  • A)You have no return route on R1 telling it how to get traffic to R2 via the GRE tunnel.

    B)There are too many masquerade rules. If I understand your desired traffic flows correctly there isn't a need for any.

    C)There are a couple of static routes that don't make a lot of sense and aren't really doing anything.
Could you post a diagram showing the two routers the GRE tunnel and connected interfaces with IP addresses. Also make note of where the default route (typically towards your ISP) should point.

If you are on newer ROS code the manual MSS clamping rules are not needed. It will create dynamic rules to accomplish this.

The DHCP relay command on wlan1 looks to be either missconfigured or just not needed.
 
altsvelu1988
just joined
Topic Author
Posts: 13
Joined: Wed Dec 17, 2014 5:30 pm
Location: Oman

Re: GRE tunnel

Sun Jan 04, 2015 6:32 pm

Hi...
Here my network diagram . Please assist me to accomplish this....

Image
 
ngnr
just joined
Posts: 11
Joined: Mon Jun 09, 2014 11:52 pm
Location: Spain

Re: GRE tunnel

Tue Jan 06, 2015 12:50 am

Aren't you missing a default (0.0.0.0/0) gateway in the routes for R2?
 
jkarras
Member Candidate
Member Candidate
Posts: 226
Joined: Fri Sep 06, 2013 3:07 am
Location: Utah, USA

Re: GRE tunnel

Wed Jan 14, 2015 4:54 am

Is wlan1 on R1 your Internet connection or just some web servers. Ngnr is correct you are missing a default route but your also just missing routes between the two devices. Do you control routing on the Intranet as well if so a GRE tunnel is possibly unnecessary.

Who is online

Users browsing this forum: dioeyandika, jessenz and 25 guests