Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Problem

The Mikrotik site is unable to ping anything on the server site. The Server site is less important right now.


OpenVPN Server config is on LINUX

port 1194
proto tcp
dev tun
ca ca.crt
cert cert.crt
key cert.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
puch route 192.168.0.0 255.255.255.0
client-to-client
keepalive 10 120
persist-key
persist-tun
ver 3
mute 20

ipv4_fowarding is enabled

Open VPN Client is on Mikrotik Router.

connect to: server.public.ip
port: 1194
mode: ip
user: user
password: passwrd
profile: openvpn-out
cert: cert
auth: sha1
cipher: blowfish 128

**openvpn-out profile**
name: openvpn-out
change tcp mss: default
use mpls: default
use compression: default
use vj compression: default
use encryption: default

With those settings mikrotik give: Connection is established and everything that should work work on the mikrotik itself

1) From mikrotik router I can't ping the TUN interface (10.8.0.2) server but can ping own TUN (10.8.0.46) and subnet on server site (192.168.0.0)

2) The clients of subnet from Mikrotik site are unable to ping anything on server site, only TUN interface on mikrotik (10.8.0.46)

3) From Server I can ping TUN interface of Mikrotik (10.8.0.46) but can't subnet on that site (192.168.2.0)

4) The clients of subnet from Server sire are unable to ping anything on Mikrotik site, only TUN interface on both Mikrotik and Server

Mikrotik interface

ether1 - dynamic.ip.addres
OPVN - 10.8.0.46 network 10.8.0.45
bridge1 - 192.168.2.1/24

Mikrotik route:

   ds.address  gw 
    0.0.0.0/0   public.ip.address reachable ether1
    10.8.0.0/24 10.8.0.45 reachable OVPN
    10.8.0.45   OVPN reachable 
    public.ip   ether1 reachable 
    192.168.0.0/24 OVPN reachable 
    192.168.2.0/24 bridge1 reachable

Mikrotik ping 192.168.0.0 without problems Clients of mikrotik can't

Server interfaces

eth0 - public.ip.addre
eth1 - 192.168.0.9
tun0 - 10.8.0.1 p-t-p:10.8.0.2

Server route:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         public.ip.addre 0.0.0.0         UG    100    0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
localnet        *               255.255.255.252 U     0      0        0 eth0
192.168.0.0     *               255.255.255.0   U     0      0        0 eth1
192.168.2.0     10.8.0.1        255.255.255.0   UG    0      0        0 tun0

Server can't ping 192.168.2.0, ping 10.8.0.46. Server Clients ping only 10.8.0.46

I assume that iptables are set correctly in some way because connection is established and mikrotik can ping anything on there other site.

mikrotik nat rule

srcnat -o ether1 -acction masquerade
share|improve this question

2 Answers 2

up vote 1 down vote accepted

Solution

On Mikrotik nat for OPVN was missing:

srcnat -o OPVN -acction masquerade

This fix the problem on Mikrotik site

share|improve this answer
    
While this solved my issue, it doesn't feel like the right solution. There must be a way to solve this via routing and firewall configuration, so that the vpn server can also access the hosts on the network local to the mikrotik client. But it's a nice little layer of security anyways. –  Daniel F Oct 20 at 10:16

If you just want access from the Mikrotik to the subnet at the other site you could indeed use a NAT rule on the Mikrotik. From your post I gather you are trying to set up a site to site VPN though where you want access to both the subnets from both sites.

To do that you just need the correct routing tables and firewalling on both sides of the connection. Try changing the gateway for the route to 192.168.2.0 from 10.8.0.1 to the address of your Mikrotik in the 10.8 range. Since your Mikrotik is the gateway to this subnet, not your own Linux server which is located on10.8.0.1.

share|improve this answer
    
Thank you for your input, but the configuration above was good, but was missing the NAT rule. Since this is standard vpn configuration vpn server is always with .1 at the end of address, and the clients are dynamic. So the ip is dynamic and if mikrotik is client he set the routing tables dynamic, no modification can me made. –  Michal Sapsa Sep 17 at 5:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.