The Mikrotik site is unable to ping anything on the server site. The Server site is less important right now.

OpenVPN Server config is on LINUX

port 1194
proto tcp
dev tun
ca ca.crt
cert cert.crt
key cert.key
dh dh1024.pem
ifconfig-pool-persist ipp.txt
puch route
keepalive 10 120
ver 3
mute 20

ipv4_fowarding is enabled

Open VPN Client is on Mikrotik Router.

connect to: server.public.ip
port: 1194
mode: ip
user: user
password: passwrd
profile: openvpn-out
cert: cert
auth: sha1
cipher: blowfish 128

**openvpn-out profile**
name: openvpn-out
change tcp mss: default
use mpls: default
use compression: default
use vj compression: default
use encryption: default

With those settings mikrotik give: Connection is established and everything that should work work on the mikrotik itself

1) From mikrotik router I can't ping the TUN interface ( server but can ping own TUN ( and subnet on server site (

2) The clients of subnet from Mikrotik site are unable to ping anything on server site, only TUN interface on mikrotik (

3) From Server I can ping TUN interface of Mikrotik ( but can't subnet on that site (

4) The clients of subnet from Server sire are unable to ping anything on Mikrotik site, only TUN interface on both Mikrotik and Server

Mikrotik interface

ether1 - dynamic.ip.addres
OPVN - network
bridge1 -

Mikrotik route:

   ds.address  gw   public.ip.address reachable ether1 reachable OVPN   OVPN reachable 
    public.ip   ether1 reachable OVPN reachable bridge1 reachable

Mikrotik ping without problems Clients of mikrotik can't

Server interfaces

eth0 - public.ip.addre
eth1 -
tun0 - p-t-p:

Server route:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         public.ip.addre         UG    100    0        0 eth0   UG    0      0        0 tun0        *      UH    0      0        0 tun0
localnet        *      U     0      0        0 eth0     *        U     0      0        0 eth1   UG    0      0        0 tun0

Server can't ping, ping Server Clients ping only

I assume that iptables are set correctly in some way because connection is established and mikrotik can ping anything on there other site.

mikrotik nat rule

srcnat -o ether1 -acction masquerade


On Mikrotik nat for OPVN was missing:

srcnat -o OPVN -acction masquerade

This fix the problem on Mikrotik site

  • While this solved my issue, it doesn't feel like the right solution. There must be a way to solve this via routing and firewall configuration, so that the vpn server can also access the hosts on the network local to the mikrotik client. But it's a nice little layer of security anyways. – Daniel F Oct 20 '14 at 10:16

If you just want access from the Mikrotik to the subnet at the other site you could indeed use a NAT rule on the Mikrotik. From your post I gather you are trying to set up a site to site VPN though where you want access to both the subnets from both sites.

To do that you just need the correct routing tables and firewalling on both sides of the connection. Try changing the gateway for the route to from to the address of your Mikrotik in the 10.8 range. Since your Mikrotik is the gateway to this subnet, not your own Linux server which is located on10.8.0.1.

  • Thank you for your input, but the configuration above was good, but was missing the NAT rule. Since this is standard vpn configuration vpn server is always with .1 at the end of address, and the clients are dynamic. So the ip is dynamic and if mikrotik is client he set the routing tables dynamic, no modification can me made. – Michal Sapsa Sep 17 '14 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.