The official Mikrotik router thread

Anthro said:
Did my RB2011 with no issue, but I do not have the most complex of setups - VLAN on the WAN interface is all
Click to expand...

Yeah, I've got a pretty complex setup. 8 VLANs (adults network, kids network, guest network, IOT network, camera network, VOIP network, server network for Synology NAS and PiHole, etc) plus a whole bunch of firewall filter rules regulating which network can talk to which under which circumstances. And then this setup is replicated across to IPv6 as well.
 
Were running 7.1 at the office, and I am using 7.2 at home. We definitely had to make changes to the config to get everything working properly, but all good for us. Neither us IPv6
 
Good morning all

I have been working on this little issue for the last 24 hours and I think maybe I am missing something.

Here is the setup:
Asus router (192.168.1.1) running OpenVPN server
Laptop can connect with client and access resources behind said router.
Mikrotik (192.168.0.1) can dial up and connect to the OVPN BUT cannot access anything on the other side, not even the router itself.

The mikrotik cannot ping the other side.
Also note that asus router has been set to only allow access to LAN, so no internet breakout.
 
killerbyte said:
Good morning all

I have been working on this little issue for the last 24 hours and I think maybe I am missing something.

Here is the setup:
Asus router (192.168.1.1) running OpenVPN server
Laptop can connect with client and access resources behind said router.
Mikrotik (192.168.0.1) can dial up and connect to the OVPN BUT cannot access anything on the other side, not even the router itself.

The mikrotik cannot ping the other side.
Also note that asus router has been set to only allow access to LAN, so no internet breakout.
Click to expand...
Is the Mikrotik picking up the route for your openvpn lan (192.168.1.x)

Are you routing the 192.168.0.x subnet on the Asus to the Mikrotik Openvpn client?
Else do you have nat/masquerade enabled on the openvpn interface on the mikrotik

ie do both sides of the networks know how to reach the othersides
 
Leno said:
Is the Mikrotik picking up the route for your openvpn lan (192.168.1.x)

Are you routing the 192.168.0.x subnet on the Asus to the Mikrotik Openvpn client?
Else do you have nat/masquerade enabled on the openvpn interface on the mikrotik

ie do both sides of the networks know how to reach the othersides
Click to expand...

I second this, this just sounds like a simple routing and masquerading problem. Just go to IP -> Routes on the Mikrotik make sure there is a route to the 192.168.1.0/24 network on the Asus. Then go to IP -> Firewall -> NAT and make sure that the VPN Client interface is excluded from masquerading.
 
Thats the thing... every NATing rule I can think of just doesn't work.

Here is the IP /Routes table:
1645260197733.png

and here are the NAT rules:

1645260398546.png

I am missing something, but I can't see the wood from the trees.
 
killerbyte said:
Can't have an "In Interface" on a srcnat > MASQ rule.
Click to expand...

Oh yes, true that. Can you try disabling the masquerade rule completely and then try pinging the other side of the VPN just to see if the masquerade rule is actually the problem? At least then you can rule it out and stop playing around with it.
 
deweyzeph said:
Oh yes, true that. Can you try disabling the masquerade rule completely and then try pinging the other side of the VPN just to see if the masquerade rule is actually the problem? At least then you can rule it out and stop playing around with it.
Click to expand...
It didnt help at all. But it was worth a try.
 
Start a ping on the MT to a resource on Asus LAN, then post picture of connections tab.

Also try change the ARP settings on 'Theron-OpenVPN' to proxy-arp

"Laptop can connect with client and access resources behind said router." I think the issue is with the MT and nothing on the Asus router.

EDIT: Please post the laptops routing table info when the laptop connects.
 
Peon said:
Start a ping on the MT to a resource on Asus LAN, then post picture of connections tab.

Also try change the ARP settings on 'Theron-OpenVPN' to proxy-arp

"Laptop can connect with client and access resources behind said router." I think the issue is with the MT and nothing on the Asus router.

EDIT: Please post the laptops routing table info when the laptop connects.
Click to expand...
I figured it out... had to turn off compression on the Asus because Mikrotik doesn't support LZO.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X