MikroTik

Posted: **Sun Feb 10, 2019 9:33 pm**

Has anyone got a CHR working as a VPN server on AWS?

We have one that connects our office (RB4011) to AWS (CHR) Via an ipsec tunnel
We've managed to get traffic flowing well from the office (10.11.1.0) to our VPC (10.100.1.0) ... after a little challenge getting MSS right!
We also managed to get the L2TP+Ipsec server running on the CHR to allow remote workers to connect in.

Remote users are getting addresses in the 10.100.1.x range just fine and can see the office computers
However, they cannot connect to anything on the VPC.
The CHR can ping the VPC hosts just fine and users in the office have no problem going through that same CHR to get to VPC hosts

Any thoughts on what we are doing wrong? (and is this the right bit of the forum to post in?)

Posted: **Wed Feb 20, 2019 7:11 am**

You try add a NAT for remote Users. Please post your config.

Posted: **Tue Mar 05, 2019 6:27 pm**

sorry, i did not seem to get a notifcation for this one

the config is pretty simple so far... I suspect I'm doing something very dumb

# mar/05/2019 16:16:30 by RouterOS 6.43.12
# software id = 
#
#
#
/interface ethernet
set [ find default-name=ether1 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full arp=proxy-arp
/interface l2tp-server
add name=l2tp-server user=""
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer profile
set [ find default=yes ] dh-group=ecp256 dpd-maximum-failures=3 \
    enc-algorithm=aes-256,aes-192,aes-128 hash-algorithm=sha256
add dpd-maximum-failures=3 name=RoadWarrior
/ip ipsec proposal
set [ find default=yes ] disabled=yes
add auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc,aes-128-cbc \
    lifetime=1h name=vpc-aws
add auth-algorithms=sha256,sha1 enc-algorithms=aes-128-cbc,3des lifetime=1h \
    name=ipsec
/ip pool
add name=VPN_dhcp_pool ranges=10.100.1.220-10.100.1.249
/ip dhcp-server
add address-pool=VPN_dhcp_pool disabled=no interface=ether1 name=dhcp1
/ppp profile
add change-tcp-mss=yes comment="road warrior profile" dns-server=\
    10.11.1.5,10.11.1.7 local-address=10.100.1.254 name=AWS_VPN only-one=no \
    remote-address=VPN_dhcp_pool use-compression=yes use-encryption=required
/interface l2tp-server server
set authentication=chap,mschap1,mschap2 enabled=yes ipsec-secret=secret \
    use-ipsec=yes
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=10.100.0.0/16 dns-server=10.11.1.5,10.11.1.7,8.8.8.8 domain=\
    somewhere.com gateway=10.100.1.254
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall nat
add action=accept chain=srcnat dst-address=10.11.0.0/16 src-address=\
    10.100.0.0/16
add action=accept chain=srcnat dst-address=10.100.0.0/16 src-address=\
    10.11.0.0/16
/ip ipsec peer
add address=1.1.1.1/32 compatibility-options=skip-peer-id-validation \
    secret=VPNSECRET
add address=2.2.2.2/32 compatibility-options=skip-peer-id-validation \
    secret=VPNSECRET
add address=0.0.0.0/0 exchange-mode=main-l2tp generate-policy=port-override \
    passive=yes profile=RoadWarrior secret=RWPassword \
    send-initial-contact=no
/ip ipsec policy
set 0 proposal=ipsec
add dst-address=10.11.0.0/16 proposal=vpc-aws sa-dst-address=1.1.1.1 \
    sa-src-address=10.100.1.254 src-address=10.100.0.0/16 tunnel=yes
add disabled=yes dst-address=10.11.0.0/16 proposal=vpc-aws sa-dst-address=\
    2.2.2.2 sa-src-address=10.100.1.254 src-address=10.100.0.0/16 \
    tunnel=yes
/ip service
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ppp secret
add name=user1 password=userpasswd profile=AWS_VPN service=l2tp
/system clock
set time-zone-autodetect=no time-zone-name=Europe/London
/system identity
set name=irevpc-subnet1-chr
/system ntp client
set enabled=yes primary-ntp=46.227.200.72 secondary-ntp=85.199.214.101

Posted: **Mon Mar 25, 2019 10:00 pm**

well, i've not made a lot of progress, but in case anyone sees this that has more clues that me

I used tcpdump on a VPC instance and confirmed that packets are making it to the server, but for some reason packets are not making it back.
it confuses me that I can reach devices another hop away (in the office) just fine but the CHR is not able to route packets back to a dial-in user coming into the CHR.

Sounds like it might be an ARP thing, but proxy-arp is enabled on eth1 on the CHR and the CHR clearly knows how to get packets back to the vpn user from another network
am i being stupid here?

Posted: **Thu Mar 28, 2019 12:00 am**

in case anyone is still looking at this I could use some thinking from someone with AWS+ CHR experience

still using tcpdump (my new best friend) . it appears that the packets from my dialin users are getting to the VPC instance but rather than send the reply (in this case a ping) back to the CHR using the mac address the ping request came from, the host is sending the reply to the mac address of the amazon gateway on 10.100.1.1
10.100.1.1 would be the default route for hosts as most traffic goes to the internet that way.

this feels like it must be a simple thing we have missed. where am I being stupid here?
gut feel is it might be in the VPC route tables...

image.png

Posted: **Thu Mar 28, 2019 7:46 pm**

just to close this out for future readers.

in the end we moved the pool range off of the VPC subnet and meticulously tracked the data flow
we needed some careful checking and fixing of security groups (we have too many that built up over time) and VPC subnet route tables
AWS routing is a bit of a challenge if you are used to seeing info from linux or windows. Very powerful but different.
in the end, after much work the CHR is doing the job and should be a flexible platform for the future.

MikroTik

CHR VPN server on AWS not reaching VPC

CHR VPN server on AWS not reaching VPC

Re: CHR VPN server on AWS not reaching VPC

Re: CHR VPN server on AWS not reaching VPC

Re: CHR VPN server on AWS not reaching VPC

Re: CHR VPN server on AWS not reaching VPC

Re: CHR VPN server on AWS not reaching VPC (solved) [SOLVED]