Home / server / Questions / 822963
In Process
Manuth Chek
Asked: 2016-12-28 23:28:38 +0800 CST

Windows L2TP VPN client has no Internet

  • 772

The L2TP/IPSec VPN server is a Mikrotik router, with these firewall configurations:

/ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0  D ;;; special dummy rule to show fasttrack counters
      chain=forward action=passthrough 

 1    ;;; VPN L2TP port 500
      chain=input action=accept protocol=udp in-interface=pppoe-out1 
      dst-port=500 

 2    ;;; VPN L2TP port 1701
      chain=input action=accept protocol=udp in-interface=pppoe-out1 
      dst-port=1701 

 3    ;;; VPN L2TP port 4500
      chain=input action=accept protocol=udp in-interface=pppoe-out1 
      dst-port=4500 

 4    ;;; VPN L2TP IPSec
      chain=input action=accept protocol=ipsec-esp in-interface=pppoe-out1 

 5    ;;; VPN L2TP AH
      chain=input action=accept protocol=ipsec-ah in-interface=pppoe-out1 

 6    ;;; Allow all from VPN
      chain=input action=accept src-address-type=local 

 7    ;;; defconf: accept ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 8    ;;; defconf: accept establieshed,related
      chain=input action=accept connection-state=established,related log=no 
      log-prefix="" 

 9    ;;; Drop SSH requests from outside
      chain=input action=drop protocol=tcp in-interface=pppoe-out1 
      dst-port=22 log=no log-prefix="" 

10    ;;; Drop Winbox connection from outside
      chain=input action=drop protocol=tcp in-interface=pppoe-out1 
      dst-port=8291 log=no log-prefix="" 

11    ;;; Drop UDP DNS requests from outside
      chain=input action=drop protocol=udp in-interface=pppoe-out1 
      dst-port=53 log=no log-prefix="" 

12    ;;; Drop TCP DNS requests from outside
      chain=input action=drop protocol=tcp dst-port=53 log=no log-prefix="" 

13    ;;; Allow ping from outside
      chain=input action=accept protocol=icmp dst-address=103.12.163.90 
      log=no log-prefix="" 

14    ;;; defconf: drop all from WAN
      chain=input action=drop in-interface=ether1 log=no log-prefix="" 

15    ;;; defconf: fasttrack
      chain=forward action=fasttrack-connection 
      connection-state=established,related log=no log-prefix="" 

16    ;;; defconf: accept established,related
      chain=forward action=accept connection-state=established,related log=no 
      log-prefix="" 

17    ;;; defconf: drop invalid
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

18    ;;; defconf:  drop all from WAN not DSTNATed
      chain=forward action=drop connection-state=new 
      connection-nat-state=!dstnat in-interface=ether1 log=no log-prefix="" 

/ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=srcnat action=masquerade out-interface=pppoe-out1 log=no 
      log-prefix="" 

 1    ;;; HTTPS remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=900 
      protocol=tcp in-interface=pppoe-out1 dst-port=900 log=no log-prefix="" 

 2    ;;; HTTP remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=443 
      protocol=tcp in-interface=pppoe-out1 dst-port=443 log=no log-prefix="" 

 3    ;;; HTTP remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=80 
      protocol=tcp in-interface=pppoe-out1 dst-port=80 log=no log-prefix="" 

 4    ;;; Plex server remote access
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=32400 
      protocol=tcp in-interface=pppoe-out1 dst-port=32400 log=no 
      log-prefix="" 

 5    ;;; HTTPS hairpin NAT
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=443 
      protocol=tcp dst-address-type=local dst-port=443 log=no log-prefix="" 

 6    ;;; HTTP hairpin NAT
      chain=dstnat action=dst-nat to-addresses=10.0.0.2 to-ports=80 
      protocol=tcp dst-address-type=local dst-port=80 log=no log-prefix="" 

 7    ;;; HTTPS hairpin NAT
      chain=srcnat action=masquerade to-addresses=10.0.0.2 protocol=tcp 
      src-address=10.0.0.0/24 dst-address=10.0.0.2 out-interface=bridge 
      dst-port=443 log=no log-prefix="" 

 8    ;;; HTTP hairpin NAT
      chain=srcnat action=masquerade to-addresses=10.0.0.2 to-ports=80 
      protocol=tcp src-address=10.0.0.0/24 dst-address=10.0.0.2 
      out-interface=bridge dst-port=80 log=no log-prefix=""

Now the strange thing is that iOS clients can connect to this VPN and reach both local network and Internet, but Windows clients can only reach the local network and not the Internet (dunno about other platforms since I don't have access to right now). I've ruled out DNS and route issues, as these Windows clients can ping global IP addresses and domain names and also tracert. Am I missing something? I've already used the same configuration for many Mikrotik routers, and what the routers with issues have in common is that the WAN connection is PPPoE:

/ip firewall filter
add chain=input action=accept comment="VPN L2TP UDP 500" in-interface=pppoe-out1 protocol=udp dst-port=500 
add chain=input action=accept comment="VPN L2TP UDP 1701" in-interface=pppoe-out1 protocol=udp dst-port=1701
add chain=input action=accept comment="VPN L2TP 4500" in-interface=pppoe-out1 protocol=udp dst-port=4500
add chain=input action=accept comment="VPN L2TP ESP" in-interface=pppoe-out1 protocol=ipsec-esp
add chain=input action=accept comment="VPN L2TP AH" in-interface=pppoe-out1 protocol=ipsec-ah

/ppp profile add change-tcp-mss=yes local-address=10.0.0.1 name=vpn-profile remote-address=pool-vpn dns-server=10.0.0.1 use-encryption=yes

/ppp secret add name="yourusername" password="yourpassword" profile=vpn-profile service=any

/interface l2tp-server server set authentication=mschap2 default-profile=vpn-profile enabled=yes max-mru=1460 max-mtu=1460 use-ipsec=yes

/ip ipsec peer add address=0.0.0.0/0 exchange-mode=main-l2tp nat-traversal=yes generate-policy=port-override secret="yourl2tpsecret" enc-algorithm=aes-128,3des
/ip ipsec proposal set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
windows mikrotik l2tp

0 Answers