Community discussions

MikroTik App
Topic Author
Posts: 25
Joined: Tue May 27, 2014 5:22 am

L2TP IPSEC Client behind NAT

Wed Mar 29, 2017 4:59 am


I have a question, is it possible to have the following configuration?

Site 1 = Mikrotik A With Public IP ex. with LAN of End clients
Site 2 = Mikrotik B With Public IP ex with Mikrotik C on Mikrotik B's LAN port, getting GW IP of with LAN of end clients getting these IP's.

What I want is to have Mikrotik A as L2TP/IPsec server and Mikrotik C as L2TP/IPsec Client and for each end client LAN's to be able to communicate with eachother ( can communicate with

I know how to do this between Mikrotik A and B already and can have the 2 LAN's communicate with eachother successfully by adding the routes to each mikrotik, but again, only one way communication with Mikrotik A and C.

I have searched many forum posts but haven't found a way to make it work for me or if my above set up is even possible... I have gotten as far as establishing an L2TP/IPsec tunnel between Mikrotik A(server) and Mikrotik C(Client). I can ping hosts on the subnet from client computers on subnet but cannot ping hosts the other way around, I can only ping (and access) the Mikrotik C's gateway... hope this makes sense and thanks in advance for an answer! Also, I do have access to Mikrotik A incase anything needs changing on there. One last thing, when I ping a host on Mikrotik C's lan, it appears the pings are getting through but replies are not being sent as I do not get ping replies on a computer behind Mikrotik A's LAN.
Forum Guru
Forum Guru
Posts: 1147
Joined: Fri Mar 24, 2017 11:15 pm
Location: USA

Re: L2TP IPSEC Client behind NAT

Thu Mar 30, 2017 11:25 pm

It should work just fine. You like are having an issue with routing on Mikrotik A. Make sure it knows how to get to the network on/behind Mikrotik C.

I tend to wrap IPSec around GRE tunnels with a RFC1918 /30 and add static routes as needed or use OSPF. I like that because the IPSec interesting traffic becomes the GRE tunnel and your users traffic just gets routed. GRE also works with broadcast and multicast if that is helpful to you.

Who is online

Users browsing this forum: dikrek, Google [Bot] and 62 guests