I have RB2011 routers (v6.22 firmware) installed in two locations.

Location A:
WAN IP: x.x.x.x (static)
LAN IP: 192.168.0.0/24

Location B:
WAN IP: y.y.y.y (dynamic, at some point in time it may get behind a NAT)
LAN IP: 192.168.1.0/24

I would like to set up a secure IPsec tunnel so that IP traffic could go from 192.168.0.0/24 to 192.168.1.0/24, and vice versa.

I read the IPsec article at Mikrotik Wiki. I guess there's more information than my brain is able to accept at once... There is an example of "Site to Site IpSec Tunnel" which seem to be very close to my needs. But it assumes static IPs on both ends, which is something I don't have... Other examples seem to be quite different, unless I missed something.

Can anyone please explain how to set it up in my case, or point me to a guide describing something similar?

If I'm not wrong for Dynamic WAN you need to run an script to check the ip every x mins.

http://wiki.mikrotik.com/wiki/IPSec_Policy_Dynamic

maybe this website also helps you:

https://aacable.wordpress.com/2012/03/3 ... ynamicdns/

Easy to do but first you need to take care of those dynamic IP addresses..... You can use them dynamically but you will have to go in to both mikrotiks each time they change and update the info for the VPN tunnel. I went the free route to take care of this issue for me. Check out no-ip.com and get yourself a free DNS associated with your dynamic IPs.

Tunnels really are simple. Look on Youtube through Greg Sowells mikrotik videos, he has some easy tutorials.

Ok, I went ahead and got a fixed IP at the other location, too.

So now I'm able to setup a tunnel exactly as described in the wiki.


Thanks for your responses!

Update:

The IPsec tunnel works good. But there is an issue: whenever the WAN link throughput becomes insufficient at either of the ends, the tunnel loses lots of packets. I'm transmitting VoIP in the tunnel, so lags and packets loss is quite critical. I am just starting to read about QoS. The way I understand it is the following:

- first of all I need to prioritize IPsec traffic between two routers, so that the tunnel itself gets maximum priority
- then the priority should be given to the VoIP traffic (in fact, it's the traffic between certain fixed IP addresses in the local network (including the tunnel))
- then the priority should go to http / https traffic
- last one should be the remaining traffic (p2p, etc)

Is this the right thinking?
Can someone please give me a hint on how to set it up properly?

I went the free route to take care of this issue for me. Check out no-ip.com and get yourself a free DNS associated with your dynamic IPs.

I went the free route to take care of this issue for me. Check out no-ip.com and get yourself a free DNS associated with your dynamic IPs.

Exactly what I use and works awesome.