Community discussions

MikroTik App
 
mpixel
newbie
Topic Author
Posts: 33
Joined: Wed Jun 24, 2009 9:58 pm

How to route from OVPN client to specific IPSEC tunel ?

Fri Oct 16, 2020 5:51 pm

We have IPSec tunel only from my local network 10.10.110.0/24 to our customer.
We have new OVPN for our clients. 192.168.10.0/24 to 192.168.10.1

Limitation: Out customer is not willing to make changes and add our new OVPN network 192.168.10.0/24 to the IPec tunnel for our OVPN network.

There is an idea to do a masquerade 192.168.10.0/24 network. But the masquarade will not give ip address from range 10.10.110.0/24, but a public address.
And besides, there is no routing table for ipsec. Only internal (?)

can you tell me how to setup mikrotik router so that the ovpn client can reach the customer's application with the ip address included in the existing ipsec tunnel?

look at attaced picture
You do not have the required permissions to view the files attached to this post.
Last edited by mpixel on Fri Oct 16, 2020 6:06 pm, edited 1 time in total.
 
Sob
Forum Guru
Forum Guru
Posts: 6076
Joined: Mon Apr 20, 2009 9:11 pm

Re: How to route from OVPN client to specific IPSEC tunel ?  [SOLVED]

Fri Oct 16, 2020 6:05 pm

Don't use masquerade, use src-nat and then you can set any address you want. IPSec doesn't use routes, it checks if source and destination matches existing policy. Once you add correct srcnat rule, it will.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
mpixel
newbie
Topic Author
Posts: 33
Joined: Wed Jun 24, 2009 9:58 pm

Re: How to route from OVPN client to specific IPSEC tunel ?

Fri Oct 16, 2020 6:19 pm

Thank you this work,
chain=srcnat action=src-nat to-addresses=10.10.110.1 src-address=192.168.10.0/24


Is it ok, that the address 10.10.110.1 is the address of the router interface?
 
Sob
Forum Guru
Forum Guru
Posts: 6076
Joined: Mon Apr 20, 2009 9:11 pm

Re: How to route from OVPN client to specific IPSEC tunel ?

Fri Oct 16, 2020 6:54 pm

All IPSec cares about is that source is in 10.10.110.0/24. It can be router's own address, or you can dedicate some other for this. It doesn't even have to be assigned anywhere.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.

Who is online

Users browsing this forum: Baidu [Spider], Bing [Bot], rugrime, Yahoo [Bot] and 63 guests