Community discussions

MikroTik App
 
marcobnn
just joined
Topic Author
Posts: 1
Joined: Thu May 16, 2024 4:29 pm

IPSec and OpenVPN

Thu May 16, 2024 5:03 pm

Hello,

I have RouterOS device with this configuration:

1) Main
- RouterOS v6.49.15
- WAN Internet access with public and static IP xxx.xxx.xxx.xxx
- LAN network is 192.168.88.0/24
- IPSec with working tunnel to the slave configured as:
peer=ike1-site2 tunnel=yes src-address=192.168.88.0/24 src-port=any dst-address=192.168.89.0/24 dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp sa-src-address=xxx.xxx.xxx.xxx sa-dst-address=yyy.yyy.yyy.yyy proposal=ike1-site2 ph2-count=2
- OpenVPN server on network 192.168.200.0/24

2) Slave
- RouterOS v7.14.3
- WAN Internet access with public and static IP yyy.yyy.yyy.yyy
- LAN network is 192.168.89.0/24
- IPSec with working tunnel to the master configured as:
peer=ike1-site1 tunnel=yes src-address=192.168.89.0/24 src-port=any dst-address=192.168.88.0/24 dst-port=any protocol=all action=encrypt level=require ipsec-protocols=esp sa-src-address=zzz.zzz.zzz.zzz sa-dst-address=xxx.xxx.xxx.xxx proposal=ike1-site2 ph2-count=2
the IPSec is working as expected and the clients on the 192.168.88/24 can communicate with the clients on the 192.168.89.0/24 and vice versa.
the OpenVPN clients are able to connect to the main RouterOS and can communicate with the clients on the 192.168.88.0/24

I would also like the OpenVPN clients to communicate with the slave clients on the 192.168.89.0/24 network.

Anyone have some hints ?

Thanks!
 
User avatar
abbio90
Member
Member
Posts: 470
Joined: Fri Aug 27, 2021 9:16 pm
Location: Oristano
Contact:

Re: IPSec and OpenVPN

Fri May 17, 2024 9:18 am

the configuration should be looked at. try placing accepts from the VPN subnet to the subnet you want to reach. and enter a Nat of the ovpn source subnet
 
sukram
just joined
Posts: 10
Joined: Mon Jan 08, 2024 1:29 am

Re: IPSec and OpenVPN

Sun May 19, 2024 10:07 pm

Does your OpenVPN push the corresponding routes for all connected networks to the client?

eg. you have your 192.168.88.0/24 route added to enable the client to connect to this subnet, now you add also the 192.168.89.0/24 subnet.

On your Slave router, you add the Route to your OpenVPN transit Subnet via the Master router. Now you should be able to send packets both ways (verify with traceroute on each end)