I made a VPN connection to my other branch office following this tutorial: https://wiki.mikrotik.com/wiki/Manual:I ... sec_tunnel
But it doesn't work quite right. I tried about 3 tutorials by now, they're all basically the same.
- Both routers connect to the internet just fine.
- Both routers can ping each other fine. (across the internet)
- IPSec connects them both together just fine, both peers are active.
- Both routers are using the same stable RouterOS and firmware
Issue:
1. Cant ping from Router 1 subnet (243.0) to Router 2 subnet (233.0).
2. Cant ping from Router 2 subnet (233.0) to Router 1 subnet (243.0).
The only thing that works fine is all traffic from Routers 2 subnet (233.0) to Routers 1 server, which has an IP of 192.168.243.10.
But funnily enough, trying the same with another IP like: Routers 2 subnet (233.0) to Routers 1 server, IP of 192.168.243.2 fails.
Router 1 config (public IP's are removed):
Code: Select all
# sep/12/2021 23:27:33 by RouterOS 6.48.4
# model = RB960PGS
/interface ethernet
set [ find default-name=ether2 ] name=Administracija poe-out=off
set [ find default-name=ether5 ] name=FREE-5 poe-out=off
set [ find default-name=ether1 ] name=Isoriniai
set [ find default-name=ether3 ] name=Vlanai45 poe-out=off
set [ find default-name=ether4 ] poe-out=off
set [ find default-name=sfp1 ] disabled=yes
/interface vlan
add interface=Vlanai45 name=Freeinet vlan-id=5
add interface=Vlanai45 name=Studentai vlan-id=4
/interface list
add exclude=dynamic name=discover
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer
add address=<removed>/32 name=ike1-site2
/ip pool
add name=Studentai ranges=192.168.244.2-192.168.244.253
add name=Administracija ranges=192.168.243.1-192.168.243.253
/ip dhcp-server
add address-pool=Studentai authoritative=after-2sec-delay disabled=no \
interface=Studentai name=StudentaiDHCP
/queue interface
set Administracija queue=ethernet-default
set Isoriniai queue=ethernet-default
set Vlanai45 queue=ethernet-default
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp"
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface list member
add interface=Administracija list=discover
add interface=Isoriniai list=discover
add interface=Vlanai45 list=discover
add interface=Freeinet list=discover
add interface=Studentai list=discover
/ip address
add address=<removed>/28 interface=Isoriniai network=<removed>
add address=192.168.243.254/24 interface=Administracija network=192.168.243.0
add address=192.168.244.254/24 interface=Studentai network=192.168.244.0
/ip dhcp-server config
set store-leases-disk=15m
/ip dhcp-server network
add address=192.168.243.0/24 dns-server=192.168.243.10,8.8.8.8 gateway=\
192.168.243.254
add address=192.168.244.0/24 dns-server=192.168.243.10,8.8.8.8 gateway=\
192.168.244.254
/ip dns
set servers=192.168.243.10,8.8.8.8
/ip dns static
add address=192.168.243.254 comment=defconf name=router.lan
/ip firewall filter
add action=fasttrack-connection chain=forward comment=established+related \
connection-state=established,related
add action=accept chain=forward comment=established+related connection-state=\
established,related
add action=drop chain=forward comment=Invalid connection-state=invalid
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.233.0/24 src-address=\
192.168.243.0/24
add action=masquerade chain=srcnat out-interface-list=all
/ip firewall raw
add action=notrack chain=prerouting dst-address=192.168.233.0/24 src-address=\
192.168.243.0/24
add action=notrack chain=prerouting dst-address=192.168.243.0/24 src-address=\
192.168.233.0/24
/ip ipsec identity
add peer=ike1-site2 secret=<removed>
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.233.0/24 peer=ike1-site2 src-address=192.168.243.0/24 \
tunnel=yes
/ip route
add distance=1 gateway=<removed>
Code: Select all
# sep/12/2021 23:26:49 by RouterOS 6.48.4
# model = RB4011iGS+
/interface ethernet
set [ find default-name=ether1 ] disabled=yes
set [ find default-name=ether6 ] disabled=yes
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] disabled=yes
set [ find default-name=ether9 ] disabled=yes
set [ find default-name=ether10 ] disabled=yes
/interface vlan
add interface=ether3 name=Adm vlan-id=3
add interface=ether5 name=Freenet vlan-id=5
add interface=ether4 name=Studentai vlan-id=4
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 10 default-vlan-id=0
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer
add address=<removed>/32 name=ike1-site1
/ip pool
add name=StudentaiPool ranges=192.168.234.2-192.168.234.253
add name=FreenetPool ranges=192.168.235.2-192.168.235.253
add name=AdmPool ranges=192.168.233.2-192.168.233.253
/ip dhcp-server
add address-pool=StudentaiPool authoritative=after-2sec-delay disabled=no \
interface=Studentai name=StudentaiDHCP
add address-pool=FreenetPool authoritative=after-2sec-delay disabled=no \
interface=Freenet name=FreenetDHCP
add address-pool=AdmPool authoritative=after-2sec-delay disabled=no \
interface=Adm name=AdmDHCP
/queue interface
set ether1 queue=ethernet-default
set ether2 queue=ethernet-default
set ether3 queue=ethernet-default
set ether4 queue=ethernet-default
set ether5 queue=ethernet-default
set ether6 queue=ethernet-default
set sfp-sfpplus1 queue=ethernet-default
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp"
/ip neighbor discovery-settings
set discover-interface-list=Mgmt
/interface list member
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=ether9 list=LAN
add interface=ether10 list=LAN
add list=LAN
add interface=ether2 list=Mgmt
add interface=sfp-sfpplus1 list=WAN
/ip address
add address=192.168.234.254/24 interface=Studentai network=192.168.234.0
add address=192.168.233.254/24 interface=Adm network=192.168.233.0
add address=<removed>/28 interface=sfp-sfpplus1 network=<removed>
add address=192.168.235.254/24 interface=Freenet network=192.168.235.0
/ip cloud
set ddns-enabled=yes update-time=no
/ip dhcp-client
add interface=sfp-sfpplus1
/ip dhcp-server network
add address=192.168.233.0/24 dns-server=<removed>,<removed> gateway=\
192.168.233.254
add address=192.168.234.0/24 dns-server=<removed>,<removed> gateway=\
192.168.234.254
add address=192.168.235.0/24 dns-server=<removed>,<removed> gateway=\
192.168.235.254
/ip dns
set servers=<removed>,<removed>
/ip firewall filter
add action=fasttrack-connection chain=forward comment=established,related \
connection-state=established,related
add action=accept chain=forward comment=established,related connection-state=\
established,related
add action=drop chain=forward comment="Drop connection is Studentai i Adm" \
in-interface=Studentai out-interface=Adm
add action=drop chain=forward comment="Drop connection is FreeNet i Adm" \
in-interface=Freenet out-interface=Adm
add action=drop chain=forward comment="drop invalid" connection-state=invalid
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.243.0/24 src-address=\
192.168.233.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface-list=WAN
/ip firewall raw
add action=notrack chain=prerouting dst-address=192.168.243.0/24 src-address=\
192.168.233.0/24
add action=notrack chain=prerouting dst-address=192.168.233.0/24 src-address=\
192.168.243.0/24
/ip ipsec identity
add peer=ike1-site1 secret=<removed>
/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.243.0/24 peer=ike1-site1 src-address=192.168.233.0/24 \
tunnel=yes
/ip route
add distance=1 gateway=<removed>