User Tools
networking:router:mikrotik_vpn_ipsec
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_ipsec [2019/08/14 14:12] gcooper |
networking:router:mikrotik_vpn_ipsec [2023/06/21 15:26] (current) gcooper |
||
|---|---|---|---|
| Line 74: | Line 74: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | ||
| - | src-address=$SubnetBehindRouter1 tunnel=yes | + | src-address=$SubnetBehindRouter1 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 110: | Line 110: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | ||
| - | src-address=$SubnetBehindRouter2 tunnel=yes | + | src-address=$SubnetBehindRouter2 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 146: | Line 146: | ||
| ===== One Side with Dynamic IP ===== | ===== One Side with Dynamic IP ===== | ||
| - | FIXME Needs verification | + | https:// |
| + | |||
| + | <note tip>To convert a S2S VPN connection from **two-sides-static** to **one-side-dynamic**: | ||
| + | |||
| + | * Modify the (dynamic IP) peer definition on the router with static WAN IP: | ||
| + | * Set the IP address to '' | ||
| + | * Select '' | ||
| + | * Deselect '' | ||
| + | * Responder | ||
| + | * Modify the (static IP) peer definition on the router with dynamic WAN IP: | ||
| + | * Set the IP address to the static WAN IP address of the other router | ||
| + | * Deselect '' | ||
| + | * Select '' | ||
| + | * Initiator | ||
| + | </ | ||
| + | |||
| + | ==== Router with Static IP ==== | ||
| + | |||
| + | :!: In this example, this router has two LAN subnets behind it. | ||
| + | |||
| + | < | ||
| + | /ip ipsec peer | ||
| + | add name=peername passive=yes | ||
| + | /ip ipsec identity | ||
| + | add peer=peername secret=yourpresharedkey | ||
| + | /ip ipsec policy | ||
| + | set 0 disabled=yes | ||
| + | add comment=" | ||
| + | 192.168.0.0/ | ||
| + | add comment=" | ||
| + | 192.168.2.0/ | ||
| + | </ | ||
| + | |||
| + | ==== Router with Dynamic IP ==== | ||
| + | |||
| + | :!: This router has a single LAN subnet behind it. | ||
| + | |||
| + | < | ||
| + | /ip ipsec peer | ||
| + | add address=123.123.123.123/ | ||
| + | /ip ipsec identity | ||
| + | add peer=peer-with-static-ip-name secret=yourpresharedkey | ||
| + | /ip ipsec policy | ||
| + | set 0 disabled=yes | ||
| + | add dst-address=192.168.0.0/ | ||
| + | add dst-address=10.10.1.0/ | ||
| + | </ | ||
| + | |||
| + | FIXME The rest of this section needs verification | ||
| http:// | http:// | ||
| Line 199: | Line 247: | ||
| ===== Firewall ===== | ===== Firewall ===== | ||
| + | |||
| + | **IPSec Firewall Rules**: https:// | ||
| http:// | http:// | ||
networking/router/mikrotik_vpn_ipsec.1565813548.txt.gz · Last modified: 2019/08/14 14:12 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
