User Tools
networking:router:mikrotik_vpn_ipsec
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_ipsec [2019/03/23 09:59] gcooper |
networking:router:mikrotik_vpn_ipsec [2023/06/21 15:26] (current) gcooper |
||
|---|---|---|---|
| Line 40: | Line 40: | ||
| :!: Note that older ROS had the default proposal with '' | :!: Note that older ROS had the default proposal with '' | ||
| - | :!: You need to use '' | + | :!: You need to use '' |
| :!: Note that we use /32 instead of the actual subnet mask of the WAN interfaces for simplicity and security. | :!: Note that we use /32 instead of the actual subnet mask of the WAN interfaces for simplicity and security. | ||
| Line 55: | Line 55: | ||
| :global SubnetBehindRouter2 " | :global SubnetBehindRouter2 " | ||
| - | :global PreSharedKey "MyPreSharedKey" | + | :global PreSharedKey "YourPreSharedKey" |
| </ | </ | ||
| Line 74: | Line 74: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | ||
| - | src-address=$SubnetBehindRouter1 tunnel=yes | + | src-address=$SubnetBehindRouter1 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 110: | Line 110: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | ||
| - | src-address=$SubnetBehindRouter2 tunnel=yes | + | src-address=$SubnetBehindRouter2 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 130: | Line 130: | ||
| </ | </ | ||
| - | :!: Try to bring up the tunnel by pinging a host (IP) from one LAN subnet to the other. | + | :!: Try to bring up the tunnel by pinging a host (IP) from one LAN subnet to the other. |
| - | :!: **Important note**: While the router will properly route traffic between the LANs at this point, the router itself does not have a route to the remote subnet. | + | :!: **Important note**: While the router will properly route traffic |
| < | < | ||
| /ip route add disabled=no dst-address=< | /ip route add disabled=no dst-address=< | ||
| + | </ | ||
| - | # for example where the remote subnet is 192.168.0.0/ | + | For example where the remote subnet is '' |
| + | |||
| + | < | ||
| /ip route add disabled=no dst-address=192.168.0.0/ | /ip route add disabled=no dst-address=192.168.0.0/ | ||
| </ | </ | ||
| ===== One Side with Dynamic IP ===== | ===== One Side with Dynamic IP ===== | ||
| + | |||
| + | https:// | ||
| + | |||
| + | <note tip>To convert a S2S VPN connection from **two-sides-static** to **one-side-dynamic**: | ||
| + | |||
| + | * Modify the (dynamic IP) peer definition on the router with static WAN IP: | ||
| + | * Set the IP address to '' | ||
| + | * Select '' | ||
| + | * Deselect '' | ||
| + | * Responder | ||
| + | * Modify the (static IP) peer definition on the router with dynamic WAN IP: | ||
| + | * Set the IP address to the static WAN IP address of the other router | ||
| + | * Deselect '' | ||
| + | * Select '' | ||
| + | * Initiator | ||
| + | </ | ||
| + | |||
| + | ==== Router with Static IP ==== | ||
| + | |||
| + | :!: In this example, this router has two LAN subnets behind it. | ||
| + | |||
| + | < | ||
| + | /ip ipsec peer | ||
| + | add name=peername passive=yes | ||
| + | /ip ipsec identity | ||
| + | add peer=peername secret=yourpresharedkey | ||
| + | /ip ipsec policy | ||
| + | set 0 disabled=yes | ||
| + | add comment=" | ||
| + | 192.168.0.0/ | ||
| + | add comment=" | ||
| + | 192.168.2.0/ | ||
| + | </ | ||
| + | |||
| + | ==== Router with Dynamic IP ==== | ||
| + | |||
| + | :!: This router has a single LAN subnet behind it. | ||
| + | |||
| + | < | ||
| + | /ip ipsec peer | ||
| + | add address=123.123.123.123/ | ||
| + | /ip ipsec identity | ||
| + | add peer=peer-with-static-ip-name secret=yourpresharedkey | ||
| + | /ip ipsec policy | ||
| + | set 0 disabled=yes | ||
| + | add dst-address=192.168.0.0/ | ||
| + | add dst-address=10.10.1.0/ | ||
| + | </ | ||
| + | |||
| + | FIXME The rest of this section needs verification | ||
| http:// | http:// | ||
| Line 194: | Line 247: | ||
| ===== Firewall ===== | ===== Firewall ===== | ||
| + | |||
| + | **IPSec Firewall Rules**: https:// | ||
| http:// | http:// | ||
networking/router/mikrotik_vpn_ipsec.1553356768.txt.gz · Last modified: 2019/03/23 09:59 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
