Community discussions

MikroTik App
 
Cablenut9
Long time Member
Long time Member
Topic Author
Posts: 542
Joined: Fri Jan 08, 2021 5:30 am

Sending all traffic through a L2TP interface

Fri Mar 26, 2021 4:30 am

I've been having lots of trouble setting up a hotspot with a wAP ac LTE6. Here's my routes:
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit 
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 A S  0.0.0.0/0                          lte1                      2
 1 ADC  123.456.789.10/32  123.456.789.10  lte1                      0
 2 ADC  192.168.1.0/24     192.168.1.6     bridge                    0
I also have a BCP L2TP/IPsec interface up and running that provides slight access to my main network. The problem is, I want to direct all traffic on the bridge, where the BCP is, through the L2TP interface which itself will be routed through LTE, instead of anything not targeting 192.168.1.xx going straight through the LTE. I tried adding the gateway IP on the main network as a route, but that messed everything up as it kept trying to push everything through that and so couldn't initiate the L2TP connection (a chicken-egg problem). II also tried adding the L2TP interface as a gateway and that didn't work either. Is there some special route rule I can add? Just so you know, the LTE interface is not on any bridge.
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 8:54 am

Assuming the wAP ac LTE6 is the client in the L2TP link,

/ip route
add dst-address=ip.of.l2tp.server gateway=lte1
add gateway=l2tp-out1

/interface lte apn set [find] default-route-distance=3


should do the trick.
 
Cablenut9
Long time Member
Long time Member
Topic Author
Posts: 542
Joined: Fri Jan 08, 2021 5:30 am

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 3:10 pm

It almost works, it gives me some new routes, but the default LTE route with a 3 distance is now labeled not-active. Is this supposed to happen?
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 3:21 pm

If I got you right, it was the desired behaviour that everything went through the L2TP tunnel, except the L2TP transport packets. Have I missed something?
 
Cablenut9
Long time Member
Long time Member
Topic Author
Posts: 542
Joined: Fri Jan 08, 2021 5:30 am

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 3:42 pm

It actually does work but the problem is that now no HTTPS traffic can get through. HTTP and other protocols like Winbox and SSH and DNS work better, but no HTTPS. Even those can't keep a connection open. Linux' curl and wget commands work only on HTTP sites. Wget shows that it connects to the server but nothing actually comes through. Winbox Torch shows me that on the home network, there's info coming from the server. Torch on the wAP ac LTE6 side shows the connection, but no traffic. That means there's some other problem, maybe having to do with MTU. I set it to 1500 and that didn't help.
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 4:20 pm

You've likely identified the issue (MTU) but not the solution.

There are two possibilities. Either you use mangle rules at one of the routers to force TCP MSS to a value corresponding to the reduction of the MTU caused by the L2TP encapsulation, or you activate use of MLPPP on the L2TP tunnel by setting mrru to 1500 and the MTU to 1500 too. In the latter case, the L2TP performs a hidden fragmentation, so large payload packets are split into two transport ones. For TCP connections this means lower efficiency than reducing the MSS.

Yet another possibility would be that you are currently blocking ICMP somewhere in your network, making it impossible for PMTUD to work properly; if the ICMP is not blocked in your own network, only the possibilities above apply.
 
Cablenut9
Long time Member
Long time Member
Topic Author
Posts: 542
Joined: Fri Jan 08, 2021 5:30 am

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 5:13 pm

Wouldn't the MRRU have to be 1600 because it needs to pass L2 MAC headers too?
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 5:22 pm

Ah, sorry, I've missed the BCP. If you really tunnel the L2, all that routing changes I gave before are not necessary if you simply tell the devices connected to the bridge to use the IP of the router at the remote end of the tunnel as their default gateway.

And yes, the MRRU must be high enough to allow 1514-byte Ethernet frames to pass through.
 
jkyawesome
newbie
Posts: 28
Joined: Mon Sep 17, 2018 12:34 am

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 6:21 pm

BCP is the best for site to site vpn. I have not seen it on other vendors routers. There are several videos on YouTube show the config. The craziest thing is BCP and MLPPP are used but nothing marked BCP or MLPPP in MikroTik.
 
Cablenut9
Long time Member
Long time Member
Topic Author
Posts: 542
Joined: Fri Jan 08, 2021 5:30 am

Re: Sending all traffic through a L2TP interface

Fri Mar 26, 2021 6:50 pm

I've found the problem. When I try to ping a device on the home network from the wAP, I can only get the packet size to 1388 bytes before it doesn't work.The "Don't Fragment" option changed nothing. Additionally, doing a packet sniff on the l2tp interface I saw that no packets above around 1300 bytes were passed by it, and those that came close are HTTPS packets generated by me doing a browser test. I tried turning up the MTU/MRU/MRRU on both sides of the l2tp interface all the way to 2000 but that did nothing. I also tried "Change TCP MSS" on both sides. What could I do next? I suspect it has to do with the LTE's MTU.
 
Cablenut9
Long time Member
Long time Member
Topic Author
Posts: 542
Joined: Fri Jan 08, 2021 5:30 am

Re: Sending all traffic through a L2TP interface  [SOLVED]

Fri Mar 26, 2021 7:21 pm

I FIXED IT! It was a MTU problem after all, the fix was to turn down the L2TP client's MTU/MRU to 1400. This seems to be because the LTE standard only has an MTU of that. I also turned down the LTE interface's MTU to 1400.

Who is online

Users browsing this forum: Google [Bot], natxo and 59 guests