MikroTik

Posted: **Sun Feb 02, 2020 12:18 pm**

Hi guys,
Please give a helping hand setting a simple VPN tunnel from my phone (iPhone) to my internal network (split tunneling, so the IPSec tunnel will only be used for traffic with destination 192.168.88.0/24) - Apple removed the PPP VPN some time ago so the only available options today are IPSec and IKEv2
I just a hAP ac² router which is running the latest stable software (6.46.2)
I've followed the example called "Road Warrior setup with Mode Conf" on Wiki page as this topology is very close to what I'm planning to achieve.
First problem is that I cannot use command

/ip ipsec user
add name=user1 password=123

It looks like starting with 6.43 ??? version the IPSec config pages/commands changed dramatically and the above command doesn't work anymore.
Can you, please, direct me to an actual step-by-step guide to can help me configure this box?
Also I've tried configure an IKEv2 but also not luckier with this one

Posted: **Sun Feb 02, 2020 6:45 pm**

L2TP works... There used to be a site, nasa security, with a tutorial. The site is no longer up. Maybe internet archive or something like that.

Posted: **Mon Feb 03, 2020 2:42 am**

Step by Step in section 5.3 of this article.
https://wiki.mikrotik.com/wiki/Manual:I ... pSec_setup

But you also need firewall rules not mentioned in that section.

    ;;; Permit L2TP VPN
    chain=input action=accept protocol=udp in-interface=ether1 dst-port=500 log=no log-prefix="" 
    chain=input action=accept protocol=udp in-interface=ether1 dst-port=4500 log=no log-prefix="" 
    chain=input action=accept protocol=udp in-interface=ether1 dst-port=1701 log=no log-prefix="" 
    chain=input action=accept protocol=ipsec-esp in-interface=ether1 log=no log-prefix=""

Posted: **Thu Feb 13, 2020 6:39 pm**

Thanks guys for your time and excuse me for my late reply.
@Van9018 I've followed the step-by-step guide you've pointed and works fine - I can establish an IPSec tunnel from my phone to the home network (the only different thing I've used is the user/pass combination, even the secret is set to "mySecret" as per example).
Two problems:
1. I cannot ping a PC located in home LAN even I've set on all interfaces (eth2,3 and 4, bridge, WLAN etc) proxy-arp function.
2. I would love to make a split tunnel where only the traffic with destination my home LAN is pushed through IPSec tunnel and any other traffic follows the normal, unencrypted path.

MikroTik

IOS VPN connection to home network

IOS VPN connection to home network

Re: IOS VPN connection to home network

Re: IOS VPN connection to home network

Re: IOS VPN connection to home network