MikroTik IPSec Tunnel with DDNS and NAT

77 Comments

Pessoft · November 4, 2016 at 00:16
Setup mentioned in the article should work also in the case when one of the routers is connected using the static IP. In such scenario, for the router connected via static IP you don’t need IP Cloud (dynamic DNS) and ip-cloud-forceupdate scheduler and for the router connected via dynamic IP you don’t need ipsec-peer-update scheduler and temporary placeholder IP set in ipsec section ( 127.99.99.99/32 ) can be configured directly ( with the known static IP ).

Pessoft · January 24, 2017 at 00:24
Thanks.
At first try to check IPSec. On both sides you should see in remote-peers established connection ( /ip ipsec remote-peers print ) and pair of mature installed SAs ( /ip ipsec installed-sa print ). Then try to ping remote Mikrotik’s internal IP and also IP of some device in remote network. If both, peers and SAs, are correct and ping still does not work via IPSec tunnel, but does locally, then it can be a routing issue. Also, I had issues with the IPSec NAT-T tunnel running on Mikrotik RouterOS 6.38 and had to upgrade to 6.38.1.

Pessoft · February 28, 2017 at 23:50
Hello,
Mikrotiks on both sites need to have IPSec traffic forwarded from their gateway routers ( in example above are these gateways called ISP routers ), so at first I suggest to check that there is 500/UDP and 4500/UDP forwarding configured on these gateways. Also check in which state are remote peers on Mikrotiks ( terminal command /ip ipsec remote-peers print ).
Regarding your second question: IPSec tunnel in config is configured to connect to remote site in case there is traffic going from local private network to remote private network ( in example above: if traffic will go from host in 10.10.10.0/24 network to network host in 10.10.20.0/24 network, then tunnel will be established from Mikrotik router 1 to Mikrotik router 2 and traffic sent through this tunnel – this works also vice versa ). So if you will have additional Mikrotik box in one of the sites with the same config as the other Mikrotik on the same site, it should work let’s say as its backup ( i.e. if there will be traffic going through additional box from local to remote private network, tunnel will be established to remote site ).

Pessoft · March 1, 2017 at 00:16
Hi DQ,
At first make sure that 500/UDP and 4500/UDP traffic is being forwarded from gateways of your MTs to MT routers.
1. 127.99.99.99/32 is just a temporary placeholder IP, it will get replaced by IP of remote peer by the script
2. There is no STUN server used in the configuration, each MT knows about the IP of remote peer from the DDNS name of remote host.
3. There actually needs to be forwarding configured before ( in the article it is in the top – situation description point 4: Each MikroTik router has IPSec protocol, NAT-Traversal (4500/UDP) and IPSec IKE (500/UDP) traffic forwarded from its gateway (ISP Router) ). This is usually done on routers using configuration called port forwarding or DMZ host.

Anton · May 27, 2017 at 22:49
guide*

Pessoft · December 8, 2017 at 22:36
Hi and thank you. Regarding VLAN routing, I didn’t test such configuration, but generally VLANs are working on OSI layer 2 and are terminated on routers when IP routing occurs. So VLANs on 2 sites are usually different logical networks. It might be worth a try to create a tunnel interface (GRE) on top of the IPSec and bridge the VLANs with tunnel. But as mentioned, I didn’t test such setup on Mikrotik platform, so it’s just a guess 😉 Another possibility (as an example) is to make sure that network in the VLAN 100 on the site A is configured correctly in terms of routing and firewall rules, that it can communicate with network in the VLAN 100 on the site B – and vise versa.

Lars · April 7, 2019 at 18:07
In terms of VLAN routing over IPsec with GRE and with dynamic protocol
ls like RIPv2 you find a very good howto here:
https://administrator.de/wissen/cisco-mikrotik-vpn-standort-vernetzung-dynamischem-routing-398932.html
Unfortunately in German but the WinBox screenshots are self explaining. With “Pessofts” above guide to dynamic IPsec peer addresses it works like a charme !!
Also the added IPsec related links at the end are worth to read !

Pessoft · December 8, 2017 at 23:13
Hi! I tested the setup also on the 6.40.5 and it works well. Your description points out that IPSec communication is not flowing between the two routers. Here are the hints to check:
– verify that routers between Mikrotiks and Internet forward port 4500/UDP to Mikrotik device
– verify that firewall on Mikrotik accepts 4500/UDP
– if router on one site is more susceptible to block communication or difficult to configure, set on the opposing site Mikrotik’s IPSec peer configuration to be “passive” and also disable there “Send Initial Contact”
– try to change the IPSec peer exchange mode on both sites to IKEv2

Pessoft · December 15, 2017 at 00:22
Hi Felix,
Try to test between hosts on both sides. Using the Torch tool you should see incoming icmp packets on gateway interface. This should help you identify on which side is the issue or whether it is general. Also make sure that you have NAT firewall rules set and in the order prior to your masquerading or other src/dst nat rules, which could influence routing of the packets.

Pessoft · June 20, 2018 at 00:05
Hi Mathew,
Based on your input, it seems that addresses in Remote Peers are looking good. Check in which state your remote peer is using /ip ipsec remote-peers print value-list. If it is established, then peer connection is fine. Otherwise have a look at logs what they say and also verify network between Mikrotiks: Are both local and remote ports in remote peer view using 4500/UDP? Are ISP routers forwarding 4500/UDP traffic to Mikrotik routers? Can you see packet counts increasing in Mikrotik firewall rules allowing 4500/UDP? Are there visible attempts to establish SA? This could give some information about what can be blocking the connection.

Mathew · June 20, 2018 at 17:58
i have 4500 and it is increasing count and also peer connection is established. Log shows after 2 SA messages no policy found/generated

Pessoft · June 20, 2018 at 22:01
It seems that peer connection works well, so the next step should be Policy review using /ip ipsec policy print. Is private network behind Mikrotik set as source address and remote network behind Mikrotik as destination address? Is SA destination address set to remote public IP? This applies also vice-verse on the other Mikrotik. Can you see in the logs what policy is missing and verify the policy configuration accordingly? It might be also beneficial to check whether Mikrotik Router OS version is up-to-date on both sides.

Pessoft · August 9, 2018 at 21:16
Hi,
At first I suggest to check firewall configuration, whether it allows ICMP ping from ( and to ) the other router. Next thing is routing: in the section “Netwatch and Route” of this article is a route created, which makes the routers reachable between each other. Also Torch tool could help identify whether ICMP pings leave router via a correct interface.

Pessoft · October 30, 2018 at 08:48
Hi,
ipsec-peer-update script updates 2 values: IP address of remote peer and SA destination address. If DNS names are used in remote peer configuration, parts of script related to update of remote peer can be omitted. So the command to create the script might look like this:
/system script add name="ipsec-peer-update-vpn01" policy=read,write source=":local peerid    \"vpn01\"\
    \n:local peerhost  \"0123456789.sn.mynetname.net\"\
    \n:local peerip    [:resolve \$peerhost]\
    \n:local policyuid\
    \n:set policyuid   [/ip ipsec policy find comment=\"\$peerid\" and sa-dst-address!=\"\$peerip\"]\
    \n:if (\$policyuid != \"\") do={\
    \n  /ip ipsec policy set \$policyuid sa-dst-address=\"\$peerip\"\
    \n  :log info \"Script ipsec-peer-update updated policy '\$peerid' with address '\$peerip'\"\
    \n}"

Pessoft · March 2, 2019 at 19:32
Hi Mouhamed,
Thanks for the info on peer command. I’ve reviewed the change log, tested the updated configuration on the latest stable RouterOS version 6.44 and updated the article. The arguments that are no longer understood by peer command in RouterOS 6.43.12 have been moved to the new profile object and are understood by the /ip ipsec profile command. RouterOS 6.44 moved also arguments auth-method and secret to the new identity object and arguments are understood by the /ip ipsec identity command.

Pessoft · March 13, 2019 at 21:57
Hi Mike,
Purpose of the script is to resolve the dynamic DNS hostname to an IP address and then update IPSec VPN configuration in a case new IP address is resolved. Script will work, if router is able to resolve the dynamic DNS hostname – probably in your case, as you mentioned, via the one LAN port.

Pessoft · March 26, 2019 at 20:40
Hi,
Yes, the point of the configuration is that both routers are behind NAT. IP Cloud sets the public IP of ISP’s router to a dynamic DNS entry – instead of the public IP of Mikrotik router, because Mikrotik is not connected directly to the public network. On remote side, script takes the IP of dynamic DNS entry and updates the IPSec configuration accordingly. Important point is that IPSec NAT-T traffic is forwarded by ISP router to the Mikrotik router.

Kyaw Swa Hein · March 28, 2019 at 18:15
Thank you sir, I tried it and i still can’t ping to other client, but route show it reachable…..Can you please guide me where to fix by mail?

Pessoft · April 1, 2019 at 20:19
Hi,
It might be caused by the firewall configuration. I sent you an email.

Pessoft · June 16, 2019 at 23:21
Hi,
You can connect more Mikrotik’s together via VPNs. If you have 3 Mikrotiks (for example A, B, C) and you want each site to communicate with any other one, just add VPN between each site (i.e. A-B, B-C, A-C). You need to create every step of the guide again for a new VPN (also scripts). Make sure that you use separate configurations for each VPN, so they do not mix up. Alternative is also to have one Mikrotik configured so it routes between VPNs and then connect all other Mikrotiks there. This routing Mikrotik will then forward traffic between tunnels and will work as a central node. In this case you will just need each site to be connected to this central node (i.e. A-B, A-C).

Pessoft · June 29, 2019 at 00:23
Hi Silvio,
Thank you for sharing your experience and I’m glad it works for you.

Pessoft · July 13, 2019 at 21:06
Hi Manuel,
127.99.99.99 is a dummy address, which is replaced automatically by the script with IP of remote Mikrotik’s dynamic DNS hostname ( IP cloud ). Watchdog enables schedule for the script whenever remote Mikrotik router is not reachable via VPN. You can check if script works, by setting again the dummy IP and then running the script manually. If IP is not replaced with remote Mikrotik’s IP by the script, then something with IP cloud configuration is not working ( you can check it further by trying to ping the remotehost name to see if it resolves to correct IP ) or incorrect hostname is set in peerhost variable of the script. You can also check if scheduler is working in the logs, where there should be the log message “changed scheduled script settings” whenever script schedule has been enabled and disabled ( when remote Mikrotik was not reachable and reachable again ).

Manuel · July 17, 2019 at 17:18
Hi, and thanks for the fast reply.
I did all you said and also double check de configuration it still doesn’t replace the dummy ip but it resolve the host with the ping i notice in the log that there is nothing related to “changed scheduled script setting”, but when i run the script manually it should change the ip. i have a couple of cuetsions that i’m not sure
should i see the ip changed in the SA Dst. Address field of ipsec/policy tab and the address in ipsec/peers tab when the script runs? or the dummy ip stay there no matter what even when the ip really changes
the schedulers needs to be disabled when are created?
in ip/cloud the update-time must be unchecked?
thanks for everything, i really need this to work and is killing me

Pessoft · July 18, 2019 at 00:01
Hi Manuel,
IP Cloud update-time decides whether time of your Mikrotik will be updated/synced from Mikrotik Cloud time servers. It is not related to configuration of IPSec tunnel and I have it unchecked as I sync the time using NTP from other sources. Schedulers when created are disabled, because netwatch controls later on when they are enabled and disabled again based on whether the remote Mikrotik is reachable. Dummy IP is there only at the beginning, as soon as the netwatch detects that remote network is not reachable, it enables the scheduler, scheduler executes the script at regular interval, script updates the IP address of IPsec configuration ( peer and SA ) with real IP addresses of remote Mikrotik. If manual start of the script updates the IP addresses in IPSec configuration for you correctly, then there is probably just an issue with your netwatch configuration. Can you check that host parameter of netwatch configuration on each Mikrotik is configured to the IP address of remote Mikrotik ( similar like mentioned in the example within article )?

Pessoft · September 29, 2019 at 23:55
Hi Emiel, run /ip service export verbose and check for settings of www and winbox services. They should have disabled="no" ( means service is enabled ), address="" ( means that connection is not restricted by IP range ) and port="SOME_NUMBER" ( should be 80 for www and 8291 for winbox by default ). If that is ok, check if you have ports 80 for www and 8291 for winbox allowed in firewall input chain from selected IPs/ranges. Be careful that you don’t grant access to these management ports from Internet or other public network.

Emiel · October 4, 2019 at 12:53
Thanks Pessoft, all settings are correct (by default). Strangely enough I can ping from local router to remote router. But I’m not able to ping from client (connected to locla router) to the remote router. In this case I’m able to connect to the (i.e.) NAS on the remote site and vice versa.

Pessoft · December 8, 2019 at 23:29
Hi Joak, thank you for your feedback. Unfortunately, I didn’t yet configure Internet connection via the IPSec tunnel, so I cannot give you exact solution, but you can find a lot of hints on this, including configuration examples, on Mikrotik Forums.

Pessoft · January 8, 2020 at 01:39
Thank you for your feedback. OpenVPN is great VPN technology, but its implementation in RouterOS is missing some security features and therefore I will not consider writing tutorial for it just now. Hopefully it will get improved in near future.

Pessoft · January 7, 2020 at 20:41
Hi, this configuration does not use any IPs for tunnel configuration, so I don’t think that it is possible to have OSPF used – although I never tried it. Maybe creating GRE tunnel over IPSec could provide OSPF capability.

Harshan · January 8, 2020 at 17:25
I have done it with GRE tunnel. But issue is with update script. Could you please help me with that. I have little or no knowledge on scripting side. Could you please email your mail ID?

Pessoft · January 29, 2020 at 22:33
Hi, method described in my article primarily addresses topics of dynamic IP assignment and ISP router on both sides. Using IKEv1 with PSK and XAUTH should work, assuming IPSec traffic ( or eventually NAT-T ) will not get blocked between your branch and central office. I’d suggest to use IKEv2 as it is more secure and has NAT-T embedded in it. Although IKEv2 does not support XAUTH, so you need to choose a different authentication.

Pessoft · August 16, 2020 at 21:35
Hello Rafael, check if VPN traffic reaches the NAT firewall rule or if some other rule is catching the traffic first in NAT table ( in such case reorder NAT rules accordingly ). Also check if you have firewall rule that accepts forwarded traffic of VPN. Both rules are mentioned in my guide, but your results might vary depending on your configuration. Also, just to be sure, check if other service on some other host is also unreachable ( maybe there is local firewall on the machine, … ).

Pessoft · August 24, 2020 at 21:51
Hi ismail, I’m not exactly sure what you need, but VPN tunnel should be accessible by devices connected to the Mikrotik as long as firewall is not blocking them. Also it is quite simple to add to the script setting of additional variables – Mikrotik Wiki can help greatly in this. Otherwise I suppose your request is a bit out of the topic of the article, so feel free to contact me with more details if you need more help.

Emiel · December 27, 2020 at 09:10
Found out it has to do with an update on IKEv2:
https://forum.mikrotik.com/viewtopic.php?f=2&t=147769#p740153

Pessoft · March 15, 2021 at 23:27
Hello, yes, you need to forward the ports necessary for VPN to the Mikrotik. For IPsec IKEv2 with NAT traversal it will be port 4500/udp. Easy way is to do it using DMZ host as you mentioned, but that will forward all ports, so make sure you do not expose some service on Internet that you do not want to. Some routers also like to terminate IPsec connections if not specifically disabled in configuration, so check also your ISP router configuration or query your ISP for it, if your VPN packets do not come through.

Pessoft · March 17, 2021 at 00:00
Most likely it is a firewall topic. Double check if there is a correct filter rule in forward chain which accepts forward between networks, as mentioned in guide, on both Mikrotiks. Also check if there is not some rule in the same chain which would affect the packets before accept rule. Next thing is to check nat rule in srcnat and dstnat chains: either you create accept rule in the same chain before any other nat rule is present ( i.e. before masquerade rule in srcnat chain ) or make sure that rules in nat table ignore IPsec. If all is ok, then check using Torch tool, where the packets get and if there are returning packets – this way you can identify if it is outgoing or incoming traffic that you need to fix. Also try ping from some DHCP host to IP of Mikrotik on remote site, which might help to identify where your packets get lost. Hope that helps.

Pessoft · March 19, 2021 at 01:43
It should be possible to configure Windows 10 firewall, so it accepts pings from more/all subnets and firewall could be enabled again then.
Regarding speed: Check real Internet connection speed at first, for example by speedtest.net to the server close to the location of remote Mikrotik. This should show if it is a general issue or issue with tunnel. Check also connection speed without using wireless network as that my impact the speed as well. Mikrotik also has a Bandwidth test, maybe you can give it a go as well to test connection between those with and without tunnel.