Russian Users MikroTik | Форум пользователей MikroTik

Пытаюсь подружить домашний mikrotik 7.2.1 c PureVPN по протоколу IKEv2. VPN по этому протоколу отлично работает с одного из компа внутри от Windows 11 и StrongSwan под Ubuntu. Цель для части адресов внутренней сети пустить весь трафик через PureVPN.

За основу был взята растиражированная всем VPN инструкция типа таких:
https://support.nordvpn.com/Connectivit ... ordVPN.htm
https://hide.me/ru/vpnsetup/mikrotik/ikev2/

С помощью нее удалось поднять IPsec Peer с проверенным сервером PureVPN
----
/ip ipsec mode-config add name="PureVPN mode config" responder=no src-address-list=under_vpn_list use-responder-dns=exclusively
/ip ipsec policy group add name=PureVPN
/ip ipsec profile add name="PureVPN profile" hash-algorithm=sha384 enc-algorithm=aes-256 dh-group=ecp256,ecp384,ecp521,ec2n185,ec2n155,,modp2048,modp1536,modp1024,modp768 lifetime=1d proposal-check=obey nat-traversal=yes dpd-interval=2m dpd-maximum-failures=5
/ip ipsec peer add name="PureVPN peer" address=se-ikev.ptoserver.com profile=PureVPN profile exchange-mode=ike2 send-initial-contact=yes
/ip ipsec proposal add name="PureVPN proposal" auth-algorithms=sha256 enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=0s pfs-group=none
/ip ipsec identity add peer=PureVPN peer auth-method=eap eap-methods=eap-mschapv2 mode-config=PureVPN mode config notrack-chain="prerouting" certificate=PureVPN
username="purevpn0s00000000" password="xxxxxxxx" generate-policy=port-strict policy-template-group=PureVPN
/ip ipsec policy add dst-address=0.0.0.0/0 group=PureVPN proposal="PureVPN proposal" src-address=0.0.0.0/0 template=yes

/ip firewall address-list add address=192.168.33.95 list=under_vpn_list
/ip firewall address-list add address=192.168.33.98 list=under_vpn_list
/ip firewall address-list add address=192.168.33.99 list=under_vpn_list
-----
Активное соединение с PureVPN поднимается, в таблице NAT появляется нужная запись
chain=srcnat action=src-nat to-addresses=188.72.87.97 src-address-list=under_vpn_list dst-address-list=!under_vpn_list
---
Виже созданное Ipsec Policy
D PureVPN peer yes 188.72.87.97/32 0.0.0.0/0 all encrypt unique 1
---
В активных пирах всё как должно быть
/ip/ipsec/active-peers> print
Flags: N - NATT-PEER
Columns: ID, STATE, UPTIME, PH2-TOTAL, REMOTE-ADDRESS
# ID STATE UPTIME PH2-TOTAL REMOTE-ADDRESS
0 N pointtoserver.com established 12m 1 86.106.103.179
---

В Firewall никакой трафик не дропается.
/ip/firewall/filter print
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked
2 ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp
3 ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept dst-address=127.0.0.1
4 ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid log=yes log-prefix="drop"
5 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=yes log-prefix="drop"
7 ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec
8 ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec
9 ;;; defconf: fasttrack
chain=forward action=fasttrack-connection hw-offload=yes connection-state=established,related log=no log-prefix=""
10 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=""
11 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=yes log-prefix="drop"
12 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=yes log-prefix="drop"
----
Исходящий трафик прекрасно видно при логировании chain=srcnat
Исходящий трафик прекрасно видно при логировании magle postrouting
https://disk.yandex.ru/i/AGaubPngCCIFOQ
Счётчики IPSEC Peer тикают согласно объемам посылаемого трафика
https://disk.yandex.ru/i/URc2hiaDEl5xGg

Но весь обратный трафик из PureVPN где-то теряется в недрах mikrotik. Подскажите куда копать?

Fasttrack пробовали отключить?

hardrockbaby писал(а): ↑22 апр 2022, 09:00 Fasttrack пробовали отключить?

Спасибо, за идею, но не помогло.
Поведение одинаковое. Исходящий из сети трафик вижу, обратный на WAN шифрованный есть, но он внутри ничего.

# apr/22/2022 19:58:04 by RouterOS 7.2.1
# software id = HBPD-PAHZ
#
# model = RBD52G-5HacD2HnD
# serial number = D7160C6695E8
/interface bridge
add admin-mac=48:8F:5A:98:ED:4F auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid=\
home wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto installation=indoor mode=ap-bridge \
ssid=home wireless-protocol=802.11
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk,wpa2-eap mode=dynamic-keys supplicant-identity=MikroTik
/ip ipsec mode-config
add name="PureVPN mode config" responder=no src-address-list=under_vpn_list
/ip ipsec policy group
add name=PureVPN
/ip ipsec profile
add dh-group=ecp256,ecp384,ecp521,ec2n185,ec2n155,modp8192,modp6144,modp4096,modp3072,modp2048,modp1536,modp1024,modp768 enc-algorithm=aes-256 hash-algorithm=\
sha384 name="PureVPN profile"
/ip ipsec peer
add address=se-ikev.ptoserver.com exchange-mode=ike2 name=PureVPN profile="PureVPN profile"
/ip ipsec proposal
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=0s name="PureVPN proposal" pfs-group=none
/ip pool
add name=dhcp ranges=192.168.33.100-192.168.33.199
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1-WAN list=WAN
/ip address
add address=192.168.33.1/24 comment=defconf interface=bridge network=192.168.33.0
/ip dhcp-client
add comment=defconf interface=ether1-WAN
/ip dhcp-server network
add address=192.168.33.0/24 comment=defconf dns-server=192.168.33.1,8.8.8.8,77.88.8.8 gateway=192.168.33.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.33.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.33.99 comment=Ubuntu list=under_vpn_list
add address=192.168.33.107 comment=Nintendo disabled=yes list=under_vpn_list
add address=192.168.33.199 list=desktop
add address=192.168.33.98 list=under_vpn_list
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid log=yes log-prefix=drop
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN log=yes log-prefix=drop
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes log-prefix=fsatfst
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked log-prefix=fsta
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log=yes log-prefix=drop
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN log=yes \
log-prefix=drop
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none log=yes log-prefix=masq out-interface-list=WAN
/ip ipsec identity
add auth-method=eap certificate=PureVPN eap-methods=eap-mschapv2 generate-policy=port-strict mode-config="PureVPN mode config" notrack-chain=prerouting peer=\
PureVPN policy-template-group=PureVPN username=purevpn0s11071214
/ip ipsec policy
add group=PureVPN proposal="PureVPN proposal" template=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Moscow
/system logging
add disabled=yes prefix=ipsec topics=ipsec
add disabled=yes prefix=pptp topics=pptp
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

xheiko писал(а): ↑22 апр 2022, 02:53 Но весь обратный трафик из PureVPN где-то теряется в недрах mikrotik. Подскажите куда копать?

/ip dhcp-server network
add address=192.168.33.0/24 comment=defconf dns-server=192.168.33.1,8.8.8.8,77.88.8.8 gateway=192.168.33.1 netmask=24

Для проверки отдать надо один днс в дхцп 1.1.1.1

Добрый день, а сертификат откуда брали? Можете поделиться как получить сертификат.