Community discussions

MikroTik App
 
User avatar
swa69er
just joined
Topic Author
Posts: 3
Joined: Sat Jan 02, 2021 11:54 am

Double NAT & no public IP for VPN

Sat Jan 02, 2021 1:37 pm

Hello, this is my first post
and I want to say Mikrotik is awesome, disruptive price in my country, best price per performance!

but I have problem with VPN. My ISP give me only private ip address, and it's double NAT (first 2 hop is private ip)

Tried almost everything and it doesn't work
PPTP SSTP OpenVPN
I tried using Mikrotik IP Cloud also as target IP for VPN, it doesn't work

Search the whole internet and here is my conclusion I need to make sure it will work
1. If I setup VPS and configure OpenVPN as server, will it route between 2 mikrotik router as VPN client?
2. If I upgrade my ISP subscription which include Dynamic Public IP, will it work?
3. I read about setting up some kind of domain routing like VPS or web page but with affordable price anyone knows about it? since I'm not good in web thing basically it makes your router has public IP that can be act as VPN destination
4. Is there any other option?

So far I'm using RPi + Ngrok but I'm planning to change all 12 router to Mikrotik and I'm afraid this must be halted for a moment
 
User avatar
hgonzale
Member Candidate
Member Candidate
Posts: 269
Joined: Thu Nov 06, 2014 1:12 pm
Location: Fuengirola, Spain
Contact:

Re: Double NAT & no public IP for VPN

Sat Jan 23, 2021 11:18 pm

Hello my friend. If both "routers" are "inside" network (not public IP) and you can't redirect ports, is IMPOSSIBLE" for reaching each other. Both are inside and is not possible to communicate directly both.

The only "way" is finding somebody with a public IP allowing you to connect BOTH router to HIS router and cross the traffic in the "middle" router.
 
RomelSan
newbie
Posts: 37
Joined: Fri Jul 06, 2012 1:53 am

Re: Double NAT & no public IP for VPN  [SOLVED]

Sun Jan 24, 2021 5:52 am

I am in the same scenario and solved by:
|Site 1| --> |Internet| --> |Ubuntu OpenVPN| --> |Site 2|, |Site 3|, |Site 4| All of them can ping the other sites.

1. Use VPS (Ubuntu LTS) with a static public IP. --> Mine is vultr.com get the cheapest VPS that give you a static IPv4
2. Install OpenVPN
3. Connect Mikrotik as client to the Ubuntu Server
4. Configure routing between sites
Done.

Keep in mind that you should learn to setup OpenVPN in Linux, it will take a couple of days but it is worth the trouble.
If you need help then PM me.

Notes:
Mikrotik supports for OpenVPN the following config.
cipher AES-256-CBC
auth SHA1
proto tcp #must tcp, udp not supported by Mikrotik
# tls-auth #no support
auth SHA1 # Only md5 or SHA1 is supported by Mikrotik
comp-lzo #not support
 
gotsprings
Forum Guru
Forum Guru
Posts: 1053
Joined: Mon May 14, 2012 9:30 pm

Re: Double NAT & no public IP for VPN

Sun Jan 24, 2021 4:31 pm

Pay the upgrade for the public IP.

The netname from cloud updates every 60 seconds and will work just fine for DNS resolving to reach your router...ONCE YOU HAVE A PUBLIC IP.
"It ain't what you don't know that gets you into trouble. It's what you know for sure that just ain't so."
Mark Twain
 
erkexzcx
Member Candidate
Member Candidate
Posts: 175
Joined: Mon Oct 07, 2019 11:42 pm

Re: Double NAT & no public IP for VPN

Sun Jan 24, 2021 11:40 pm

You can't access Mikrotik router if it's behind NAT (which is owned by ISP).

But you can open the tunnel from your Mikrotik to VPN server, especially if you have another Mikrotik router with public IP. And I mean this: viewtopic.php?f=23&t=169538
 
User avatar
swa69er
just joined
Topic Author
Posts: 3
Joined: Sat Jan 02, 2021 11:54 am

Re: Double NAT & no public IP for VPN

Mon Feb 22, 2021 6:09 pm

Hello my friend. If both "routers" are "inside" network (not public IP) and you can't redirect ports, is IMPOSSIBLE" for reaching each other. Both are inside and is not possible to communicate directly both.

The only "way" is finding somebody with a public IP allowing you to connect BOTH router to HIS router and cross the traffic in the "middle" router.
You can't access Mikrotik router if it's behind NAT (which is owned by ISP).

But you can open the tunnel from your Mikrotik to VPN server, especially if you have another Mikrotik router with public IP. And I mean this: viewtopic.php?f=23&t=169538
I agree. There is no way VPN could work without public IP

Pay the upgrade for the public IP.

The netname from cloud updates every 60 seconds and will work just fine for DNS resolving to reach your router...ONCE YOU HAVE A PUBLIC IP.
Correct, the only way and easiest way pay for internet plan with public IP
unfortunately, $100 upgrade in 7 location bleeds my pocket monthly

I am in the same scenario and solved by:
|Site 1| --> |Internet| --> |Ubuntu OpenVPN| --> |Site 2|, |Site 3|, |Site 4| All of them can ping the other sites.

1. Use VPS (Ubuntu LTS) with a static public IP. --> Mine is vultr.com get the cheapest VPS that give you a static IPv4
2. Install OpenVPN
3. Connect Mikrotik as client to the Ubuntu Server
4. Configure routing between sites
Done.

Keep in mind that you should learn to setup OpenVPN in Linux, it will take a couple of days but it is worth the trouble.
If you need help then PM me.
Thanks for the solution. I'm thinking about this in a whole month. And you are right Vultr is the cheapest VPS I found so far

Have you tried OpenVPN Cloud? or AWS free tier + OpenVPN

Thank you for all your responses, you guys are awesome
 
sindy
Forum Guru
Forum Guru
Posts: 6844
Joined: Mon Dec 04, 2017 9:19 pm

Re: Double NAT & no public IP for VPN

Mon Feb 22, 2021 10:23 pm

Depending on how the NATs in question behave, in particular whether the source port of a UDP packet sent from your router's WAN IP is kept as the packet goes through the NATs all the way to the public IP, it may be possible to establish an IPsec tunnel between the two devices. The source port must be kept unchanged for both devices which want to talk to each other in order that this worked.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
erkexzcx
Member Candidate
Member Candidate
Posts: 175
Joined: Mon Oct 07, 2019 11:42 pm

Re: Double NAT & no public IP for VPN

Tue Feb 23, 2021 9:59 am

Thanks for the solution. I'm thinking about this in a whole month. And you are right Vultr is the cheapest VPS I found so far

Have you tried OpenVPN Cloud? or AWS free tier + OpenVPN

Just FYI - Mikrotik ROS can be installed on x86_64 hardware, and I mean virtual machine. What I am trying to say that you can setup RouterOS on VPS, I've done it in Linode. Monthly cost of your instance + single purchase of ROS licence ($40 for L4) and you can setup VPN in your familiar ROS environment. :) But using Linux distro, like Debian, you can setup your own ipsec/ike2 VPN server using Strongswan, but it would be significantly harder if you've never done it before...

And if you decide to use Mikrotik ROS, you can follow the same guide I've shared few comments up. Basically you can end up having a public IP for your router which is behind NAT. EoIP on top of IPSEC/IKE2. :) P.S. Don't go for OpenVPN - it's slow.
 
User avatar
swa69er
just joined
Topic Author
Posts: 3
Joined: Sat Jan 02, 2021 11:54 am

Re: Double NAT & no public IP for VPN

Tue Feb 23, 2021 10:23 am

Depending on how the NATs in question behave, in particular whether the source port of a UDP packet sent from your router's WAN IP is kept as the packet goes through the NATs all the way to the public IP, it may be possible to establish an IPsec tunnel between the two devices. The source port must be kept unchanged for both devices which want to talk to each other in order that this worked.
how likely ipsec pass through NAT between 2 private IP?



Just FYI - Mikrotik ROS can be installed on x86_64 hardware, and I mean virtual machine. What I am trying to say that you can setup RouterOS on VPS, I've done it in Linode. Monthly cost of your instance + single purchase of ROS licence ($40 for L4) and you can setup VPN in your familiar ROS environment. :) But using Linux distro, like Debian, you can setup your own ipsec/ike2 VPN server using Strongswan, but it would be significantly harder if you've never done it before...

And if you decide to use Mikrotik ROS, you can follow the same guide I've shared few comments up. Basically you can end up having a public IP for your router which is behind NAT. EoIP on top of IPSEC/IKE2. :) P.S. Don't go for OpenVPN - it's slow.
interesting. I see the other post, and I don't find any cons in your tutorial. but I'm still learning about it
 
sindy
Forum Guru
Forum Guru
Posts: 6844
Joined: Mon Dec 04, 2017 9:19 pm

Re: Double NAT & no public IP for VPN

Tue Feb 23, 2021 10:31 am

how likely ipsec pass through NAT between 2 private IP?
I have a positive experience with "normal" ISPs and a negative one with mobile ones, which do not keep the original port.

interesting. I see the other post, and I don't find any cons in your tutorial. but I'm still learning about it
I've looked at that topic too, and unless I've missed something, the responder (server) must have a public IP or port-forwarding from a public IP must be possible. So not applicable for your case.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
erkexzcx
Member Candidate
Member Candidate
Posts: 175
Joined: Mon Oct 07, 2019 11:42 pm

Re: Double NAT & no public IP for VPN

Tue Feb 23, 2021 10:45 am

I've looked at that topic too, and unless I've missed something, the responder (server) must have a public IP or port-forwarding from a public IP must be possible. So not applicable for your case.
User still has to purchase VPS with public IP in order to have public IP. Linode was just an example (that's what I've been using). This way user can have ROS running somewhere in DC:

It looks something like this, but I've never done, so mistakes are possible:
  • Connect from "behind NAT Mikrotik" to purchased VPS server using IPSEC/IKE2 (or different protocol).
  • Establish EoIP tunnel (or any other tunnel) between these two on top of IPSEC/IKE2 (or different protocol).
  • Add EoIP interface to bridges on both sides, mark as "Trusted", ensure your VPS gets IP from your physical "behind-the-nat" router.
  • Perform port forwarding in VPS.
But user did not ask for public IP. User asked for VPN server, so all of this above could be avoided and just simply buying VPS, installing VPN server (with or without ROS along it) and that's it. But if your aim is to access resources on the LAN - you need to use something like I've mentioned above. Getting VPS is (IMO) the easiest and likely the cheapest way to get public IP.

Who is online

Users browsing this forum: akakua, andkar, apo357, Bing [Bot], kennethtipton, Note, PPFilip, smitas3400, Znevna and 141 guests