Hey Guys,
Been beating myself up over why I cant get my VPN to work correctly after I setup a Three WAN autofailover.
I can open up a VPN connection to said router no problem. I do a whats my ip on the PC connected to the router via VPN and it reports the correct IP on said router. I can browse the internet also just fine.
What I cant do is make any local connections on said routers side as well as unable to connect to router itself using local address.
I really am not sure which way to go with this.
I have added my setup for you guys to see and see if I can get this working.
Thanks in advance.
# nov/06/2018 14:53:59 by RouterOS 6.43.4
# software id = 02I2-SBD9
#
# model = RB1100x4
# serial number = 91D80979CDFD
/interface ethernet
set [ find default-name=ether1 ] name=1-House speed=100Mbps
set [ find default-name=ether2 ] name=2-CODECS speed=100Mbps
set [ find default-name=ether3 ] name=3-Access-Points speed=100Mbps
set [ find default-name=ether11 ] auto-negotiation=no name=11-ATT-PRI-2nd \
speed=100Mbps
set [ find default-name=ether12 ] name=12-Broadwave-Main speed=100Mbps
set [ find default-name=ether13 ] name=13-ATT-FIBER-3rd speed=100Mbps
set [ find default-name=ether4 ] disabled=yes speed=100Mbps
set [ find default-name=ether5 ] disabled=yes speed=100Mbps
set [ find default-name=ether6 ] disabled=yes speed=100Mbps
set [ find default-name=ether7 ] disabled=yes speed=100Mbps
set [ find default-name=ether8 ] disabled=yes speed=100Mbps
set [ find default-name=ether9 ] disabled=yes speed=100Mbps
set [ find default-name=ether10 ] disabled=yes speed=100Mbps
/interface list
add name=wan
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
add enc-algorithms=aes-256-cbc,3des lifetime=8h name=proposal1 pfs-group=none
/ip pool
add name=House-DHCP ranges=172.16.1.200-172.16.1.240
add name=Access-Point-DHCP ranges=192.168.10.100-192.168.10.250
add name=CODECS ranges=192.168.1.200-192.168.1.250
/ip dhcp-server
add address-pool=House-DHCP disabled=no interface=1-House name=House
add address-pool=Access-Point-DHCP disabled=no interface=3-Access-Points \
name=Access-Point
add address-pool=CODECS disabled=no interface=2-CODECS name=CODECS
/ppp profile
add dns-server=172.16.0.1,8.8.8.8 local-address=172.16.0.1 name=L2TP-Profile \
remote-address=House-DHCP
set *FFFFFFFE dns-server=172.16.0.1,8.8.8.8 local-address=172.16.0.1 \
remote-address=House-DHCP
/interface l2tp-server server
set authentication=chap,mschap2 enabled=yes ipsec-secret=Engineering777XDX
/interface list member
add interface=11-ATT-PRI-2nd list=wan
add interface=12-Broadwave-Main list=wan
add interface=13-ATT-FIBER-3rd list=wan
/interface pptp-server server
set default-profile=L2TP-Profile enabled=yes
/ip address
add address=172.16.0.1/23 interface=1-House network=172.16.0.0
add address=192.168.10.1/24 interface=3-Access-Points network=192.168.10.0
add address=162.251.176.148/29 interface=12-Broadwave-Main network=\
162.251.176.144
add address=192.168.1.1/24 interface=2-CODECS network=192.168.1.0
add address=12.186.95.210/29 interface=11-ATT-PRI-2nd network=12.186.95.208
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid disabled=no \
interface=13-ATT-FIBER-3rd
/ip dhcp-server network
add address=172.16.0.0/23 dns-server=8.8.8.8,8.8.4.4 gateway=172.16.0.1
add address=192.168.1.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.1.1
add address=192.168.10.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.10.1
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=drop chain=input comment="RDC 3389 DROP" dst-port=3389 log=yes \
log-prefix="RDC 3389 DROP" protocol=tcp src-address-list=blacklist
add action=drop chain=input comment="Blacklist Drop Input" log-prefix=\
"Blacklist Drop Input" src-address-list=blacklist
add action=drop chain=forward comment="Blacklist Drop Forward" log-prefix=\
"Blacklist Drop Forward" src-address-list=blacklist
add action=drop chain=forward comment=\
"Drop invalid connections through router" connection-state=invalid
add action=drop chain=input dst-port=53 in-interface=11-ATT-PRI-2nd protocol=\
udp
add action=drop chain=input dst-port=53 in-interface=13-ATT-FIBER-3rd \
protocol=udp
add action=drop chain=input dst-port=53 in-interface=12-Broadwave-Main \
protocol=udp
add action=accept chain=input connection-state=established
add action=accept chain=input connection-state=related
add action=accept chain=input protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=input dst-port=53 in-interface=!11-ATT-PRI-2nd \
protocol=udp
add action=accept chain=input dst-port=53 in-interface=!12-Broadwave-Main \
protocol=udp
add action=accept chain=input dst-port=53 in-interface=!13-ATT-FIBER-3rd \
protocol=udp
add action=add-src-to-address-list address-list=blacklist \
address-list-timeout=4w2d chain=input connection-state=new dst-port=22-23 \
in-interface-list=wan protocol=tcp src-address-list=ssh
add action=add-src-to-address-list address-list=ssh address-list-timeout=10m \
chain=input connection-state=new dst-port=22-23 in-interface-list=wan \
protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat dst-address=172.16.0.0/23
add action=masquerade chain=srcnat dst-address=192.168.10.1
add action=masquerade chain=srcnat dst-address=192.168.1.1
add action=masquerade chain=srcnat out-interface=11-ATT-PRI-2nd
add action=masquerade chain=srcnat out-interface=12-Broadwave-Main
add action=masquerade chain=srcnat out-interface=13-ATT-FIBER-3rd \
out-interface-list=all
add action=dst-nat chain=dstnat comment="WKWF Tieline 8040" dst-port=8040 \
log=yes log-prefix="wkwf tieline" protocol=tcp to-addresses=192.168.1.40 \
to-ports=80
add action=dst-nat chain=dstnat comment="Sugarlaoaf PIRA 8107" dst-port=8107 \
log=yes log-prefix="Sugarloaf PIRA" protocol=tcp to-addresses=\
172.16.0.107 to-ports=8107
add action=dst-nat chain=dstnat comment="MODEM PC 9898" dst-port=9898 log=yes \
log-prefix="MODEM PC VNC" protocol=tcp to-addresses=172.16.0.107 \
to-ports=5900
add action=dst-nat chain=dstnat comment="Tanyas PC RDC 9939" dst-port=9939 \
log=yes log-prefix="Tanya's PC" protocol=tcp to-addresses=172.16.0.121 \
to-ports=3389
add action=dst-nat chain=dstnat comment="WWUS Comrex 8041" dst-port=8041 log=\
yes log-prefix="WWUS COMREX" protocol=tcp to-addresses=192.168.1.41 \
to-ports=80
add action=dst-nat chain=dstnat comment="WAVK Barix 8042" dst-port=8042 log=\
yes log-prefix="WAVK Barix" protocol=tcp to-addresses=192.168.1.42 \
to-ports=80
add action=dst-nat chain=dstnat comment="WCNK Barix 8043" dst-port=8043 \
protocol=tcp to-addresses=192.168.1.43 to-ports=80
add action=dst-nat chain=dstnat comment="TAV WCTH Barix 8044" dst-port=8044 \
log-prefix="WCTH Barix" protocol=tcp to-addresses=192.168.1.44 to-ports=\
80
add action=dst-nat chain=dstnat comment="TAV WFKZ Barix 8045" dst-port=8045 \
log-prefix="WFKZ Barix" protocol=tcp to-addresses=192.168.1.45 to-ports=\
80
add action=dst-nat chain=dstnat comment="TAV Air Mon TCP 8046" dst-port=8046 \
log=yes log-prefix="TAV AIR MON Barix" protocol=tcp to-addresses=\
192.168.1.46 to-ports=80
add action=dst-nat chain=dstnat comment="WFKZ Remote VNC 6184" dst-port=6184 \
log=yes log-prefix="WFKZ VNC " protocol=tcp to-addresses=172.16.0.184 \
to-ports=5900
add action=dst-nat chain=dstnat comment="MODEM PC VNC 6107" dst-port=6107 \
log=yes log-prefix="MODEM PC VNC " protocol=tcp to-addresses=172.16.0.107 \
to-ports=5900
/ip firewall raw
add action=drop chain=prerouting disabled=yes log=yes log-prefix=\
"Preroute Blacklist" src-address-list=blacklist
/ip ipsec peer
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override \
passive=yes secret=Engineering777XDX
/ip route
add check-gateway=ping distance=1 gateway=1.1.1.1 routing-mark=wan1
add check-gateway=ping distance=2 gateway=1.0.0.1 routing-mark=wan1
add check-gateway=ping distance=3 gateway=4.2.2.4 routing-mark=wan1
add distance=1 dst-address=172.16.0.0/23 gateway=1-House pref-src=172.16.0.1 \
routing-mark=wan1 scope=10
add distance=1 dst-address=192.168.1.0/24 gateway=2-CODECS pref-src=\
192.168.1.1 routing-mark=wan1 scope=10
add distance=1 dst-address=192.168.10.0/24 gateway=3-Access-Points pref-src=\
192.168.10.1 routing-mark=wan1 scope=10
add check-gateway=ping distance=1 gateway=162.251.176.145
add check-gateway=ping distance=2 gateway=12.186.95.209
add check-gateway=ping distance=3 gateway=108.90.36.1
add distance=1 dst-address=1.0.0.1/32 gateway=12.186.95.209 scope=10
add distance=1 dst-address=1.1.1.1/32 gateway=162.251.176.145 scope=10
add distance=1 dst-address=4.2.2.4/32 gateway=108.90.36.1 scope=10
/ip route rule
add dst-address=0.0.0.0/0 src-address=172.16.0.0/23 table=wan1
add dst-address=0.0.0.0/0 src-address=192.168.0.0/16 table=wan1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=XXXXXXXXX password=XXXXXXXXXprofile=L2TP-Profile service=pptp
/system clock
set time-zone-name=America/New_York
/system identity
set name=KW-Sugarloaf-Router
/system routerboard settings
set silent-boot=no
/system scheduler
add comment="Download spamnaus list" interval=3d name=DownloadSpamhausList \
on-event=DownloadSpamhaus policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/01/1970 start-time=18:59:43
add comment="Apply spamnaus List" interval=3d name=InstallSpamhausList \
on-event=ReplaceSpamhaus policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/01/1970 start-time=19:04:43
add comment="Download dshield list" interval=3d name=DownloadDShieldList \
on-event=Download_dshield policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/01/1970 start-time=19:09:43
add comment="Apply dshield List" interval=3d name=InstallDShieldList \
on-event=Replace_dshield policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/01/1970 start-time=19:14:43
add comment="Download malc0de list" interval=3d name=Downloadmalc0deList \
on-event=Download_malc0de policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/01/1970 start-time=19:09:43
add comment="Apply malc0de List" interval=3d name=Installmalc0deList \
on-event=Replace_malc0de policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=jan/01/1970 start-time=19:14:43
/system script
add dont-require-permissions=no name=DownloadSpamhaus owner=Engineer policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\
\n/tool fetch url=\"http://joshaven.com/spamhaus.rsc\" mode=http;\
\n:log info \"Downloaded spamhaus.rsc from Joshaven.com\";\
\n"
add dont-require-permissions=no name=ReplaceSpamhaus owner=Engineer policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\
\n/ip firewall address-list remove [find where comment=\"SpamHaus\"]\
\n/import file-name=spamhaus.rsc;\
\n:log info \"Removed old Spamhaus records and imported new list\";\
\n"
add dont-require-permissions=no name=Download_dshield owner=Engineer policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\
\n/tool fetch url=\"http://joshaven.com/dshield.rsc\" mode=http;\
\n:log info \"Downloaded dshield.rsc from Joshaven.com\";\
\n"
add dont-require-permissions=no name=Replace_dshield owner=Engineer policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\
\n/ip firewall address-list remove [find where comment=\"DShield\"]\
\n/import file-name=dshield.rsc;\
\n:log info \"Removed old dshield records and imported new list\";\
\n"
add dont-require-permissions=no name=Download_malc0de owner=Engineer policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\
\n/tool fetch url=\"http://joshaven.com/malc0de.rsc\" mode=http;\
\n:log info \"Downloaded malc0de.rsc from Joshaven.com\";\
\n"
add dont-require-permissions=no name=Replace_malc0de owner=Engineer policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="\
\n/ip firewall address-list remove [find where comment=\"malc0de\"]\
\n/import file-name=malc0de.rsc;\
\n:log info \"Removed old malc0de records and imported new list\";\
\n"
/tool e-mail
set address=209.209.217.166 from=KWROUTER@rpengmnro.com
/tool netwatch
add down-script="/tool e-mail send to=\"engineer@rpengmnro.com\" subject=\"KW \
Router Status Change\" body=\"ATT FIBER LINK DOWN\"\r\
\n:log info \"ATT FIBER LINK Email Notification\"" host=108.90.36.1 \
up-script="/tool e-mail send to=\"engineer@rpengmnro.com\" subject=\"KW Ro\
uter Status Change\" body=\"Main Link UP\"\r\
\n:log info \"Main Link UP Email notification\""
add down-script="/tool e-mail send to=\"engineer@rpengmnro.com\" subject=\"KW \
Router Status Change\" body=\"BROADWAVE LINK DOWN\"\r\
\n:log info \"BROADWAVE LINK DOWN Email notification\"" host=\
162.251.176.145 up-script="/tool e-mail send to=\"engineer@rpengmnro.com\"\
\_subject=\"KW Router Status Change\" body=\"BROADWAVE LINK UP\"\r\
\n:log info \"BROADWAVE LINK UP Email notification\""
add down-script="/tool e-mail send to=\"engineer@rpengmnro.com\" subject=\"KW \
Router Status Change\" body=\"ATT PRI LINK DOWN\"\r\
\n:log info \"ATT PRI LINK DOWN Email notification\"" host=12.186.95.209 \
up-script="/tool e-mail send to=\"engineer@rpengmnro.com\" subject=\"KW Ro\
uter Status Change\" body=\"ATT PRI LINK UP\"\r\
\n:log info \"ATT PRI LINK UP Email notification\""