User Tools
networking:router:mikrotik_vpn_ipsec
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_ipsec [2022/02/24 11:16] gcooper |
networking:router:mikrotik_vpn_ipsec [2023/06/21 15:26] (current) gcooper |
||
|---|---|---|---|
| Line 74: | Line 74: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | add dst-address=$SubnetBehindRouter2 sa-dst-address=$Router2WanAddr sa-src-address=$Router1WanAddr \ | ||
| - | src-address=$SubnetBehindRouter1 tunnel=yes | + | src-address=$SubnetBehindRouter1 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 110: | Line 110: | ||
| /ip ipsec policy | /ip ipsec policy | ||
| add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | add dst-address=$SubnetBehindRouter1 sa-dst-address=$Router1WanAddr sa-src-address=$Router2WanAddr \ | ||
| - | src-address=$SubnetBehindRouter2 tunnel=yes | + | src-address=$SubnetBehindRouter2 |
| # NAT bypass rule | # NAT bypass rule | ||
| Line 150: | Line 150: | ||
| <note tip>To convert a S2S VPN connection from **two-sides-static** to **one-side-dynamic**: | <note tip>To convert a S2S VPN connection from **two-sides-static** to **one-side-dynamic**: | ||
| - | * Modify the (dynamic IP) peer on the router with static WAN IP: | + | * Modify the (dynamic IP) peer definition |
| * Set the IP address to '' | * Set the IP address to '' | ||
| * Select '' | * Select '' | ||
| * Deselect '' | * Deselect '' | ||
| * Responder | * Responder | ||
| - | * Modify the (static IP) peer on the router with dynamic WAN IP: | + | * Modify the (static IP) peer definition |
| * Set the IP address to the static WAN IP address of the other router | * Set the IP address to the static WAN IP address of the other router | ||
| * Deselect '' | * Deselect '' | ||
| Line 162: | Line 162: | ||
| </ | </ | ||
| - | Router with Static IP | + | ==== Router with Static IP ==== |
| :!: In this example, this router has two LAN subnets behind it. | :!: In this example, this router has two LAN subnets behind it. | ||
| Line 169: | Line 169: | ||
| /ip ipsec peer | /ip ipsec peer | ||
| add name=peername passive=yes | add name=peername passive=yes | ||
| - | /ip ipsec profile | ||
| - | set [ find default=yes ] enc-algorithm=aes-256, | ||
| /ip ipsec identity | /ip ipsec identity | ||
| add peer=peername secret=yourpresharedkey | add peer=peername secret=yourpresharedkey | ||
| Line 181: | Line 179: | ||
| </ | </ | ||
| - | Router with Dynamic IP | + | ==== Router with Dynamic IP ==== |
| :!: This router has a single LAN subnet behind it. | :!: This router has a single LAN subnet behind it. | ||
| Line 196: | Line 194: | ||
| </ | </ | ||
| - | + | FIXME The rest of this section needs verification | |
| - | FIXME Needs verification | + | |
| http:// | http:// | ||
networking/router/mikrotik_vpn_ipsec.1645726607.txt.gz · Last modified: 2022/02/24 11:16 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
