User Tools
networking:router:mikrotik_vpn_ipsec
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_ipsec [2022/02/24 10:38] gcooper |
networking:router:mikrotik_vpn_ipsec [2023/06/21 15:26] (current) gcooper |
||
|---|---|---|---|
| Line 74: | Line 74: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | ||
| - | src-address=$SubnetBehindRouter1 tunnel=yes | + | src-address=$SubnetBehindRouter1 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 110: | Line 110: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | ||
| - | src-address=$SubnetBehindRouter2 tunnel=yes | + | src-address=$SubnetBehindRouter2 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 150: | Line 150: | ||
| <note tip>To convert a S2S VPN connection from **two-sides-static** to **one-side-dynamic**: | <note tip>To convert a S2S VPN connection from **two-sides-static** to **one-side-dynamic**: | ||
| - | * Modify the (dynamic IP) peer on the static | + | * Modify the (dynamic IP) peer definition |
| * Set the IP address to '' | * Set the IP address to '' | ||
| - | * Select Passive | + | * Select |
| * Deselect '' | * Deselect '' | ||
| + | * Responder | ||
| + | * Modify the (static IP) peer definition on the router with dynamic WAN IP: | ||
| + | * Set the IP address to the static WAN IP address of the other router | ||
| + | * Deselect '' | ||
| + | * Select '' | ||
| + | * Initiator | ||
| </ | </ | ||
| - | FIXME Needs verification | + | ==== Router with Static IP ==== |
| + | |||
| + | :!: In this example, this router has two LAN subnets behind it. | ||
| + | |||
| + | < | ||
| + | /ip ipsec peer | ||
| + | add name=peername passive=yes | ||
| + | /ip ipsec identity | ||
| + | add peer=peername secret=yourpresharedkey | ||
| + | /ip ipsec policy | ||
| + | set 0 disabled=yes | ||
| + | add comment=" | ||
| + | 192.168.0.0/ | ||
| + | add comment=" | ||
| + | 192.168.2.0/ | ||
| + | </ | ||
| + | |||
| + | ==== Router with Dynamic IP ==== | ||
| + | |||
| + | :!: This router has a single LAN subnet behind it. | ||
| + | |||
| + | < | ||
| + | /ip ipsec peer | ||
| + | add address=123.123.123.123/ | ||
| + | /ip ipsec identity | ||
| + | add peer=peer-with-static-ip-name secret=yourpresharedkey | ||
| + | /ip ipsec policy | ||
| + | set 0 disabled=yes | ||
| + | add dst-address=192.168.0.0/ | ||
| + | add dst-address=10.10.1.0/ | ||
| + | </ | ||
| + | |||
| + | FIXME The rest of this section needs verification | ||
| http:// | http:// | ||
networking/router/mikrotik_vpn_ipsec.1645724308.txt.gz · Last modified: 2022/02/24 10:38 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
