Community discussions

MikroTik App
 
sigbjornl
just joined
Topic Author
Posts: 9
Joined: Mon Jan 18, 2010 9:32 am

IPSec disables local access to RouterOS

Sun Apr 03, 2011 3:26 pm

Hi,

I have a problem with IPSEC. When I enable an IPSEC tunnel on one of my routers, all access to the addresses set at source address in the IPSEC policy is lost. The IPSEC tunnel is working find and routing traffic, but I cannot ping, ssh, or get any kind of connectivity to the routeros locally on Router B. All local connectivity is working just fine on Router A. If I disable the IPSEC policy on Router B, local traffic is restored. I have to connect to the WAN address on Router B to gain access to the router.

On RouterA I have the subnets 192.168.2.0/24, 192.168.3.0/24, 192.168.4.0/24.
On RouterB I have the subnet 192.168.1.0/24

I have the following IPSEC policies in place on RouterA:
0 src-address=192.168.0.0/16:any dst-address=192.168.1.0/24:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=1.2.3.4 sa-dst-address=4.3.2.1 proposal=default priority=2

And the following IPSEC policy in place on RouterB:
0 src-address=192.168.1.0/24:any dst-address=192.168.0.0/16:any protocol=all action=encrypt level=require ipsec-protocols=esp tunnel=yes sa-src-address=4.3.2.1 sa-dst-address=1.2.3.4 proposal=default priority=2

Any clues to what might be going wrong here?


Rgds,
Siggi
 
User avatar
andrewluck
Forum Veteran
Forum Veteran
Posts: 702
Joined: Fri May 28, 2004 9:05 pm
Location: Norfolk, UK

Re: IPSec disables local access to RouterOS

Sun Apr 03, 2011 9:51 pm

Your problem is the policy you have defined on router B.

192.168.0.0/16 includes the routers local subnet 192.168.1.0/14. You will have to be more specific with this network definition so that the local LAN isn't included. Maybe setup separate policies for each of the remote networks.

Regards

Andrew
 
sigbjornl
just joined
Topic Author
Posts: 9
Joined: Mon Jan 18, 2010 9:32 am

Re: IPSec disables local access to RouterOS

Mon Apr 04, 2011 1:31 am

Hi,

Thanks for your reply. I was afraid it would come to that. However those policies worked just fine with the old Watchguard firewall. Is there any way around this?

There is actually a lot more subnets behind Router A, and I really don't want to specify one for each subnet. Is there a way to do this with RouterOS and BGP or OSPF?


Rgds,
Siggi
 
psamsig
Member Candidate
Member Candidate
Posts: 161
Joined: Sun Dec 06, 2009 1:36 pm
Location: Denmark

Re: IPSec disables local access to RouterOS

Mon Apr 04, 2011 9:11 pm

I haven't found the 'right' way to do this, and too have had several different brads of VPN routers that had no problem with a setup like that. On RouterOS I have solved it so far, by access the router through the external IP (from the inside net), of course that gets slightly complicated unless you have a static external address.
 
sloop
just joined
Posts: 7
Joined: Mon Jun 05, 2006 12:54 am

Re: IPSec disables local access to RouterOS

Sat May 28, 2011 1:05 am

I figured out how to fix this based on taylorc's post in this thread http://forum.mikrotik.com/viewtopic.php?f=2&t=29635

add an ipsec policy

src address= Mikrotik LAN interface, i.e. 192.168.1.1
dst address= LAN network, i.e. 192.168.1.0/24
protocol= all
action= none
level= require
ipsec protocols= esp
tunnel= NO

I added the above policy in winbox, but you need to then make it the first policy by opening a terminal
in terminal type:
/ip ipsec policy
move 1 0
assuming you previously only had 1 policy, it moves your new policy to be #0 (top).

Who is online

Users browsing this forum: almdandi, kronos, mrkacg, MSN [Bot] and 112 guests