User Tools
networking:router:mikrotik_vpn_s2s_static
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_vpn_s2s_static [2014/04/06 21:08] gcooper |
— (current) | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Mikrotik IPSec Site to Site VPN ====== | ||
| - | http:// | ||
| - | |||
| - | http:// | ||
| - | |||
| - | http:// | ||
| - | |||
| - | ===== Mikrotik Routers on Both Ends with Static IPs ===== | ||
| - | |||
| - | **Diagram**: | ||
| - | |||
| - | **Video for Diagram**: http:// | ||
| - | |||
| - | **From the Mikrotik Wiki**: http:// | ||
| - | |||
| - | {{ : | ||
| - | |||
| - | ==== IPSec Components ==== | ||
| - | |||
| - | On each Mikrotik router: | ||
| - | |||
| - | * Peer Definition | ||
| - | * Phase 1 | ||
| - | * Policy Definition | ||
| - | * Phase 2 | ||
| - | * Proposal | ||
| - | * Settings used in Phase 2 | ||
| - | * Cisco Transform Set | ||
| - | * Default proposal already exists and works well with static IPs | ||
| - | * NAT Bypass Rule | ||
| - | * S2S traffic won't pass until done | ||
| - | |||
| - | ==== Variables for Both Routers ==== | ||
| - | |||
| - | Modify these for your networks and paste them at the CLI of both routers: | ||
| - | |||
| - | :!: Note that we use /32 instead of the actual subnet mask of the WAN interfaces for simplicity and security. | ||
| - | |||
| - | < | ||
| - | :global Router1WanAddr " | ||
| - | :global Router1WanCidr " | ||
| - | |||
| - | :global Router2WanAddr " | ||
| - | :global Router2WanCidr " | ||
| - | |||
| - | :global SubnetBehindRouter1 " | ||
| - | :global SubnetBehindRouter2 " | ||
| - | |||
| - | :global PreSharedKey " | ||
| - | </ | ||
| - | |||
| - | ==== Router 1 ==== | ||
| - | |||
| - | Paste this into the CLI of router 1: | ||
| - | |||
| - | < | ||
| - | # Peer Definition | ||
| - | /ip ipsec peer | ||
| - | add address=$Router2WanCidr port=500 auth-method=pre-shared-key secret=" | ||
| - | |||
| - | # Policy Definition | ||
| - | /ip ipsec policy | ||
| - | add src-address=$SubnetBehindRouter1 src-port=any dst-address=$SubnetBehindRouter2 dst-port=any \ | ||
| - | sa-src-address=$Router1WanAddr sa-dst-address=$Router2WanAddr \ | ||
| - | tunnel=yes action=encrypt proposal=default | ||
| - | |||
| - | # NAT bypass rule | ||
| - | /ip firewall nat | ||
| - | add chain=srcnat action=accept comment=" | ||
| - | src-address=$SubnetBehindRouter1 dst-address=$SubnetBehindRouter2 | ||
| - | |||
| - | # Cleanup | ||
| - | /system script environment | ||
| - | remove Router1WanAddr | ||
| - | remove Router1WanCidr | ||
| - | remove Router2WanAddr | ||
| - | remove Router2WanCidr | ||
| - | remove SubnetBehindRouter1 | ||
| - | remove SubnetBehindRouter2 | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | ==== Router 2 ==== | ||
| - | |||
| - | Paste this into the CLI of router 2: | ||
| - | |||
| - | < | ||
| - | # Peer Definition | ||
| - | /ip ipsec peer | ||
| - | add address=$Router1WanCidr port=500 auth-method=pre-shared-key secret=" | ||
| - | |||
| - | # Policy Definition | ||
| - | /ip ipsec policy | ||
| - | add src-address=$SubnetBehindRouter2 src-port=any dst-address=$SubnetBehindRouter1 dst-port=any \ | ||
| - | sa-src-address=$Router2WanAddr sa-dst-address=$Router1WanAddr \ | ||
| - | tunnel=yes action=encrypt proposal=default | ||
| - | |||
| - | # NAT bypass rule | ||
| - | /ip firewall nat | ||
| - | add chain=srcnat action=accept comment=" | ||
| - | src-address=$SubnetBehindRouter2 dst-address=$SubnetBehindRouter1 | ||
| - | |||
| - | # Cleanup | ||
| - | /system script environment | ||
| - | remove Router1WanAddr | ||
| - | remove Router1WanCidr | ||
| - | remove Router2WanAddr | ||
| - | remove Router2WanCidr | ||
| - | remove SubnetBehindRouter1 | ||
| - | remove SubnetBehindRouter2 | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | :!: Important note: While the router will properly route traffic between the LANs at this point, the router itself does not have a route to the remote subnet. | ||
| - | |||
| - | < | ||
| - | /ip route add disabled=no dst-address=< | ||
| - | |||
| - | # for example where the remote subnet is 192.168.0.0/ | ||
| - | /ip route add disabled=no dst-address=192.168.0.0/ | ||
| - | </ | ||
| - | |||
| - | ===== One Side with Dynamic/ | ||
| - | |||
| - | FIXME | ||
| - | |||
| - | :!: If you have more than one peer, especially if any other peers are statically addresses, change the '' | ||
| - | |||
| - | On router with static address, adjust the peer definition from above: | ||
| - | |||
| - | < | ||
| - | /ip ipsec peer | ||
| - | |||
| - | set address=0.0.0.0/ | ||
| - | set generate-policy=port-override [find] | ||
| - | </ | ||
| - | |||
| - | and remove or disable any existing policies, possibly deleting all like: | ||
| - | |||
| - | < | ||
| - | /ip ipsec policy remove [find] | ||
| - | </ | ||
| - | |||
| - | ===== VPN Status ===== | ||
| - | |||
| - | Check status: | ||
| - | |||
| - | < | ||
| - | /ip ipsec remote-peers print | ||
| - | /ip ipsec installed-sa print | ||
| - | /ip ipsec statistics print | ||
| - | /ip ipsec policy print stats | ||
| - | </ | ||
| - | |||
| - | ===== Multiple Subnets Behind Routers ===== | ||
| - | |||
| - | Add an additional policy for the additional subnet to both routers similar to the first. | ||
| - | |||
| - | ===== Close All IPsec Connections ===== | ||
| - | |||
| - | < | ||
| - | /ip ipsec remote-peers kill-connections | ||
| - | </ | ||
| - | |||
| - | :!: The tunnel will not necessarily come up on its own. Traffic destined for the remote network will bring the tunnel up automatically. | ||
| - | |||
| - | ===== Troublshooting ===== | ||
| - | |||
| - | ==== Logging ==== | ||
| - | |||
| - | **System -> Logginging -> Add -> Topics -> IPSec -> Memory** | ||
| - | |||
| - | ===== Firewall ===== | ||
| - | |||
| - | **L2TP/ | ||
| - | |||
| - | * TCP port 1701 | ||
| - | * L2TP | ||
| - | * UDP port 500 | ||
| - | * Internet Security Association and Key Management Protocol (ISAKMP) | ||
| - | * To negotiate security method (password, certificate, | ||
| - | * AH (Protocol ID 50) | ||
| - | * Authentication Header | ||
| - | * ESP (Protocol ID 51) | ||
| - | * Encapsulated Secure Payload | ||
| - | * UDP Port 4500 | ||
| - | * NAT Traversal (NAT-T) | ||
| - | |||
| - | Accept L2TP/IPSec: | ||
| - | |||
| - | < | ||
| - | /ip firewall filter add chain=input action=accept protocol=tcp dst-port=1701 comment=" | ||
| - | /ip firewall filter add chain=input action=accept protocol=udp dst-port=500 comment=" | ||
| - | /ip firewall filter add chain=input action=accept protocol=ipsec-ah comment=" | ||
| - | /ip firewall filter add chain=input action=accept protocol=ipsec-esp comment=" | ||
| - | </ | ||
networking/router/mikrotik_vpn_s2s_static.1396840104.txt.gz · Last modified: 2014/04/06 21:08 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
