IPSec/L2TP and Network Resources

krafg · Mon Jun 11, 2018 5:29 pm

Hi, I configured a Mikrotik with IPSec/L2TP successfully, but I can´t acces to shared folders (Windows SMB), can't configure UAP with (UniFi Controller) and can't access to Mikrotik by MAC address ("CDP" it's not working by VPN).

I can access to network devices by HTTP/HTTPS and do ping.

I use this tutorial: https://www.youtube.com/watch?v=oeSgOurbkr8

Local Network: 192.168.1.0/24 (192.168.1.1 = Mikrotik)
VPN pool: 172.16.0.1-172.16.0.5

/interface bridge
add arp=proxy-arp fast-forward=no name=bridge1
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=ether2 ] arp=proxy-arp
set [ find default-name=ether3 ] arp=proxy-arp
set [ find default-name=ether4 ] arp=proxy-arp
set [ find default-name=ether5 ] arp=proxy-arp
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
/ip pool
add name=dhcp_pool1 ranges=192.168.1.2-192.168.1.99
add name=vpn_pool1 ranges=172.16.0.1-172.16.0.5
/ip dhcp-server
add address-pool=dhcp_pool1 authoritative=after-2sec-delay disabled=no interface=bridge1 name=dhcp1
/ppp profile
add dns-server=8.8.8.8,8.8.4.4 local-address=192.168.1.1 name=profile1 remote-address=vpn_pool1
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
/interface bridge settings
set use-ip-firewall=yes
/ip neighbor discovery settings
set default-for-dynamic=yes
/interface l2tp-server server
set enabled=yes
/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1-WAN
/ip dhcp-server lease
add address=192.168.1.3 comment="Antena 2" mac-address=44:D9:E7:02:D0:B0 server=dhcp1
add address=192.168.1.2 comment="Antena 1" mac-address=44:D9:E7:02:D1:31 server=dhcp1
add address=192.168.1.246 mac-address=A8:20:66:1A:65:95 server=dhcp1
add address=192.168.1.251 mac-address=D8:5D:E2:CD:7B:A9 server=dhcp1
add address=192.168.1.253 mac-address=48:BA:4E:51:59:DA server=dhcp1
add address=192.168.1.252 always-broadcast=yes mac-address=AC:1F:74:73:77:B2 server=dhcp1
add address=192.168.1.254 always-broadcast=yes mac-address=1C:65:9D:8F:71:04 server=dhcp1
add address=192.168.1.14 mac-address=1C:39:47:B8:EA:A8 server=dhcp1
add address=192.168.1.12 mac-address=F0:76:1C:B1:D7:DF server=dhcp1
add address=192.168.1.249 mac-address=60:67:20:C7:5A:D4 server=dhcp1
add address=192.168.1.250 always-broadcast=yes mac-address=D4:6A:6A:34:05:D5 server=dhcp1
add address=192.168.1.13 mac-address=D0:53:49:74:A8:5E server=dhcp1
add address=192.168.1.248 always-broadcast=yes mac-address=10:7B:44:27:21:A0 server=dhcp1
add address=192.168.1.247 mac-address=B8:44:D9:B7:B0:56 server=dhcp1
add address=192.168.1.245 mac-address=B8:09:8A:C8:B0:A5 server=dhcp1
add address=192.168.1.244 always-broadcast=yes mac-address=F8:59:71:88:02:E3 server=dhcp1
add address=192.168.1.11 mac-address=A4:17:31:64:0D:D8 server=dhcp1
add address=192.168.1.17 client-id=1:28:92:4a:34:4f:47 comment="Servidor NAS" mac-address=28:92:4A:34:4F:47 server=dhcp1
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.1.3-192.168.1.243 list=LIST
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN
add action=dst-nat chain=dstnat dst-port=37777 in-interface=ether1-WAN protocol=tcp to-addresses=192.168.1.108
add action=dst-nat chain=dstnat dst-port=8291 in-interface=ether1-WAN protocol=tcp to-addresses=192.168.1.1
/ip ipsec peer
add address=0.0.0.0/0 dh-group=modp1024 exchange-mode=main-l2tp generate-policy=port-override secret=XXXXXXXXXXXXXXXXX
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add local-address=192.168.1.1 name=namenamename password=passwordpasswordpassword profile=profile1 service=l2tp
/system clock
set time-zone-name=America/Santiago
/system ntp client
set enabled=yes primary-ntp=200.54.149.19 secondary-ntp=200.1.19.4

To connect to the VPN I use Windows 10 integrated VPN client.

Regards.

krafg · Mon Jun 11, 2018 8:56 pm

It's like layer 2 communication isn't possible.

I not known why.

Regards.

vilpalu · Tue Jun 12, 2018 9:41 am

IPsec is layer 3 protocol. It do not forward broadcast packets, only IP packets.

sindy · Tue Jun 12, 2018 1:14 pm

The L2TP name is confusing. L2TP does support bridging (L2) mode, but it is just one of possible modes, and the Windows native VPN client does not support it.

The fact that L2TP is secured using IPsec has nothing to do with that, as even without IPsec the L2TP is tunnelling everything via UDP over L3.

krafg · Tue Jun 12, 2018 2:01 pm

I already seemed suspicious. And is there some type of VPN that allows me to do what I need using Windows as a client?

Thanks and regards.

vilpalu · Tue Jun 12, 2018 3:34 pm

you may refer ipsec over l2tp, not l2tp over ipsec.

sindy · Tue Jun 12, 2018 4:01 pm

The only VPN I know whose Windows client supports L2 tunnelling is OpenVPN. Its Mikrotik implementation is, however, far from optimal. But you may also consider a small Mikrotik next to the PC which would establish an L2 tunnel using L2TP (over IPsec) in bridge mode, or EoIP over IPsec.

krafg · Tue Jun 12, 2018 10:00 pm

Ok, thanks for all.

Regards.

Van9018 · Tue Jun 12, 2018 11:12 pm

I thought there was a trick for this.

If server IP of L2TP/IPSec is the IP of your ether2 ip, and ether2 arp mode is proxy-arp, then it would work? I haven't tested this myself.

if broadcasts won't work, then SMB will still work if you use IP or WINS or DNS.

sindy · Wed Jun 13, 2018 12:57 pm

I thought there was a trick for this.

If server IP of L2TP/IPSec is the IP of your ether2 ip, and ether2 arp mode is proxy-arp, then it would work? I haven't tested this myself.

if broadcasts won't work, then SMB will still work if you use IP or WINS or DNS.

These are different things. ARP proxy functionality allows the router to respond with its own MAC address to ARP requests for IPs outside the requestor's subnet, so the requestor then sends the packets to the router and the router forwards them to the actual destination at L3, but this is not the same like L2 forwarding. The OP requires full L2 transparency.

krafg · Thu Jun 14, 2018 2:39 am

In fact, previously I tried it and isn't worked for me.

I will to try configure with OpenVPN.

Regards.

vilpalu · Thu Jun 14, 2018 10:25 am

In fact, previously I tried it and isn't worked for me.

I will to try configure with OpenVPN.

Regards.

openvpn support at router os is very poor, because implementation of openvpn in router os use TCP transport which leads in huge performance loss. I suggest to try l2tp only.

krafg · Thu Jun 14, 2018 2:57 pm

And I can have L2TP and OpenVPN?

I no will have problems?

Regards.

krafg · Wed Jun 20, 2018 3:49 am

Ok, I configured OpenVPN, and I can see the network over HTTP and ping, but again I can't see the network resouces, UAP access points, and Mikrotik neighbors.

/ip pool
add name=OpenVPN ranges=10.0.0.2-10.0.0.10
/ip neighbor discovery settings
set default-for-dynamic=yes
/interface ovpn-server server
set auth=sha1 certificate=SERVER-OVPN cipher=aes256 enabled=yes require-client-certificate=yes
/ppp profile
add dns-server=8.8.8.8,8.8.4.4 local-address=10.0.0.1 name=OpenVPN only-one=no remote-address=OpenVPN use-encryption=yes
/ppp secret
add name=XXXXXX password=XXXXXX profile=OpenVPN service=ovpn

Certificates:

https://prnt.sc/jwyhx0

OVPN file:

client
dev tun
proto tcp-client
remote XXXX
port 1194
nobind
persist-key
persist-tun
tls-client
remote-cert-tls server
ca cert_export_CA-OVPN.crt
cert cert_export_CLIENT-OVPN.crt
key cert_export_CLIENT-OVPN.key
verb 4
mute 10
cipher AES-256-CBC
auth SHA1
auth-user-pass
secret auth-nocache
;redirect-gateway def1
route 10.0.0.0 255.255.255.0
route 192.168.1.0 255.255.255.0

Regards.

martix77 · Wed Jun 20, 2018 9:52 am

Hi!

To have IPSec/L2TP working at layer 2 level, you should have the VPN address pool in the same broadcast domain of your LAN. Example:
LAN: 192.168.1.0/24
VPN Pool: 192.168.1.10-192.168.1.20

Then in the PPP you should configure as termination address the same address of the Mikrotik (e.g. 192.168.1.1) and configure the proxy-arp on the interface (bridge or ethernet) where the Mikrotik is connected to the LAN.

Regards!

sindy · Wed Jun 20, 2018 1:21 pm

To have IPSec/L2TP working at layer 2 level, you should have the VPN address pool in the same broadcast domain of your LAN. Example:
...
Then in the PPP you should configure as termination address the same address of the Mikrotik (e.g. 192.168.1.1) and configure the proxy-arp on the interface (bridge or ethernet) where the Mikrotik is connected to the LAN.

Unfortunately, proxy-arp and L2 tunnel are not the same. Proxy-arp means that the router responds with its own MAC address to ARP requests for IP addresses in one of its subnets, not that it forwards L2 frames with broadcast dst-mac-address to these subnets.

To use an actual L2 bridging functionality of L2TP, you need to indicate a local bridge in the profile to which the /interface l2tp-client (on client side) and /interface l2tp-server server or /ppp secret (on server side) refer.

krafg · Wed Jun 20, 2018 2:54 pm

Hi!

To have IPSec/L2TP working at layer 2 level, you should have the VPN address pool in the same broadcast domain of your LAN. Example:
LAN: 192.168.1.0/24
VPN Pool: 192.168.1.10-192.168.1.20

Then in the PPP you should configure as termination address the same address of the Mikrotik (e.g. 192.168.1.1) and configure the proxy-arp on the interface (bridge or ethernet) where the Mikrotik is connected to the LAN.

Regards!

I tried too, but not works for me. For this reason is that I tried to configure a OVPN if it works, but anyway I have the same results.

Regards.

sindy · Wed Jun 20, 2018 3:20 pm

For OpenVPN, you need to use the TAP mode to have L2 bridging support. So in the ovpn file on the client, replace dev tun by dev tap, and on the Mikrotik, set the bridge in profile the way I've described above for L2TP.

krafg · Wed Jun 20, 2018 5:42 pm

Now I can't connect.

Something bad I did.

Regards.

idlemind · Wed Jun 20, 2018 8:18 pm

Just to make sure we're hitting all the right points. The video covers a remote access VPN and your requirements that are not working are:

SMB based file access
MAC based access to a MikroTik
UniFi AP registration with a controller

The UniFi AP item is what's throwing me for a loop. Are you really in need of connecting 2 locations together (site-to-site) VPN? Both?

Note: If you are trying to adopt a UniFi AP remotely it uses a couple of methods similar to how Cisco discovers controllers. You can add a DNS record, use a DHCP option (43) or locally set the controller IP via SSH.

https://help.ubnt.com/hc/en-us/articles ... ontrollers

krafg · Wed Jun 20, 2018 9:14 pm

I need remote access VPN, not site to site VPN, because I need to access by any network. As you see, I'm using a Mikrotik as server and a PC with OpenVPN software as client.

The point of UAP is the less important to me right now. The most important requirement is the SMB access for file sharing.

Regards.

idlemind · Wed Jun 20, 2018 9:19 pm

I need remote access VPN, not site to site VPN, because I need to access by any network. As you see, I'm using a Mikrotik as server and a PC with OpenVPN software as client.

The point of UAP is the less important to me right now. The most important requirement is the SMB access for file sharing.

Regards.

Sounds good, lastly could clarify the MAC telnet requirement. Is their a reason you NEED that vs traditional IPv4 or IPv6 access to the MikroTik over the remote access VPN?

krafg · Wed Jun 20, 2018 10:42 pm

It's for configure new mikrotiks remotely removing default configuration.

Regards.

krafg · Thu Jun 21, 2018 7:39 pm

OK! Finally I can connect using TAP-dev. I changed in OVPN server Mode from IP to Ethernet and voilá.

SMB: Keep trying!

UAP: I can see the AP's in Wireless Controller. OK!
CDP: Now can see the Mikrotik over neighbors in WinBox and can access over MAC. OK!

regards.

idlemind · Thu Jun 21, 2018 11:07 pm

You'll have to post an updated config of the MikroTik to further troubleshoot SMB.

Your comment about UniFi, are you running the controller on the VPN client? Is this VPN client meant to be transient and change networks all the time but stay connected via VPN?

krafg · Fri Jun 22, 2018 12:07 am

The VPN isn`t for stay 24/7 connected. Is for file sharing by SMB and for network administration.

The UniFi controller is running on my PC and in the same PC is running OpenVPN client software. Anyway I believe that is OK for now.

Now, I can see some computers, but I disabled Windows Firewall. I not have installed a diferent firewall and I'm running Windows 10 Enterprise.

The main purpose of this VPN is the file sharing, especifically with a NAS that stay in the network. This NAS is a computer running FreeNAS. The problem is that I can`t see it.

My workgroup is "WORKGROUP" and I not know if I connect physically at the network, I can see this NAS.

Anyway apparently the Mikrotik it seems to working fine and the OVPN client too.

The problem now seems stay between FreeNAS and my firewall.

Regards.

krafg · Tue Jun 26, 2018 12:10 am

Ok, I have news.

If I connect physically to the network, I can see the NAS, but over VPN I can´t.

Then, I change the pool of VPN to the same subnet as local network and WORKS, inclusive with Windows firewall enabled.

Now I thinking something like the SMB protocol can't be routed between OpenVPN range (10.0.0.0/24) and the LAN range (192.168.1.0/24).

Any ideas?

Regards.

idlemind · Tue Jun 26, 2018 12:18 am

Ok, I have news.

If I connect physically to the network, I can see the NAS, but over VPN I can´t.

Then, I change the pool of VPN to the same subnet as local network and WORKS, inclusive with Windows firewall enabled.

Now I thinking something like the SMB protocol can't be routed between OpenVPN range (10.0.0.0/24) and the LAN range (192.168.1.0/24).

Any ideas?

Regards.

Starting simple, Is the gateway of the NAS set to point to the router with OpenVPN or at least a route on the NAS for 10.0.0.0/24 towards the router? Also, discovery may not route. You may need to access the UNC path directly. (\\192.168.1.<ip-of-nas>\<share>)

krafg · Tue Jun 26, 2018 3:29 pm

No. But ideally I need that the VPN users can see all computers over SMB, not the NAS only.

Anyway I can modify the subnet and pools for leave all on the same subnet and with this I can completly solve all this case, but anyway is good know if I can do something.

Regards.

IPSec/L2TP and Network Resources [SOLVED]

IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources

Re: IPSec/L2TP and Network Resources [SOLVED]

Who is online