Peer's ID does not match certificate #1112
Comments
|
@AuthorShin Hello! The IKEv2 VPN server address or remote ID (if any) that you set on the RouterOS client must exactly match the VPN server address in the output of the IKEv2 helper script. The local ID (if any) should be set to the VPN client name (e.g. vpnclient). Unfortunately, I don't have a RouterOS device to test. The instructions [1] were contributed by @Unix-User. [1] https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/ikev2-howto.md#routeros |
|
|
|
@hwdsl2 @Unix-User Thank you very much for the great help.
|
|
Hello! |
The error showing in your screen say that the certificate is not found.
Then import the certificate;
|
|
@Unix-User , thx a lot for helping! @hwdsl2 , maybe add final step in the guide for noob RouterOS users, like me? After you have working IPSec peer, to make all devices go via the VPN, you will need to set the firewall for the IP range on this network. For example your IP range is 192.168.10.0/24, so to make all devices connected to the Mikrotik router go via the VPN tunnel, we use the following command: /ip firewall address-list Please note that the range of the IP addresses will be different on your network. If you need only one device go via the VPN, find the internal IP address of this device connected to this router. For example the IP address of this device is 192.168.10.254 In such case open the new terminal and use the following commands: /ip firewall address-list Now you will need to assign the Firewall address list to the mode config. Use the following commands: /ip ipsec mode-config Great, you have connected your device to a your VPN server! To make sure the connection was successful, open the ipleak.net website and check if it shows the IP and DNS addresses of your server. |
|
@denislmk Thank you for your suggestions! The instructions were improved in #1124 by @Unix-User, which I think has covered the major points in your comment. |
|
Hello! @Unix-User, To test ROS (which is behind another route), an MAC notebook is wireless connected to ROS, with DHCP IP assigned = 192.168.55.108 , Set the THESE_ADDRESSES_GO_THROUGH_VPN = 192.168.55.108. From ipec policy, the tunnel is enable and active From ip route, there is an entity 192.168.43.0/24 route to ROS wan port. Problem: Previously ROS l2tp/ipsec BCP tunnel was establish but the performance is only 1/20 bandwidth, want to disable ipsec with a 2nd DHCP server, as it is just IPTV channel. but no sure how security for server side. Hope the performance in ROS->alphine will improve more. |
|
Hello @carmineyiu |
|
Thank, |
|
I redo config in Mikrotik, now traceroute show traffic is thru my alpine-ikev2 server. If remote config my mikrotik (ikev2 client) from server, can traffic thru this ikev2 tunnel? |
|
@carmineyiu |
|
Hello everyone! Appreciate for the great manual It really works! I will be grateful if you will help me to investigate my issue below: host myip.opendns.com resolver1.opendns.com The problem is - the connection is very slow, the website usually does not open. I have changed the MTU size, but no luck: The packets does not drops on server side: What should check and change to normally serf the internet? Thank you in advance! |
on my router i set dhcp to run a script that automatically adds an entry for the lease to
My setup was done using the steps described in the documentation, on a ubuntu server, with an RB941-2nD I get these results on a 2.4ghz wifi connection:
I dont have any other restrictions on network of my oracle-ubuntu server, firewall an so. check if your network speed is not being affected by traficshaping or somthing like this. |
|
Thank you for the advice. I have used the script - the problem is the same, the connection is very slow, sometimes I can use the speedtest and it only shows the download speed, the upload does not work. Mikrotik config has attached. The approximate connection scheme from mu side: mikrotik (nat) -- provider router (nat) -- internet -- AWS. Hope to see another advice. |
|
On Fri, 25 Mar 2022, martold wrote:
Thank you for the advice. I have used the script - the problem is the same, the connection is very slow, sometimes I can use
the speedtest and it only shows the download speed, the upload does not work. Mikrotik config has attached. The approximate
connection scheme from mu side: mikrotik (nat) -- provider router (nat) -- internet -- AWS.
|
|
Thank you for the article, but unfortunattley it did not work. The problem still the same. |
|
Any working solutions for problem with vpn+mikrotik? |
|
I did not get any new advices, the problem still the same. Now thinking about to upgrade the mikrotik to 7 version and try to setup wireguard connection. |
|
Try open a new Topic about it in Mikrotik Forum. |
|
I also see a very slow connection via mikrotik If I connect to the same vpn server via android strongswan client it works absolutely fine However, via mikrotik it cannot even open ipleak.net UPD: |
|
The tunnel works on MikroTik, but it's just too sloooow! Hardly anything opens! |
After some investigation I came up with the following conclusion. |
Mine (MikroTik HAP AC3) does support hardware accelerated IPsec. CPU utilization barely goes anywhere, it must have something to do with settings. Because I also tried testing VPN with setting up WireGuard peer on the router and tunneling a client's traffic through it, the performance of WireGuard was miles better than IPsec. The only downside of WG is that it isn't HW accelerated. |
|
https://libreswan.org/wiki/FAQ#My_ssh_sessions_hang_or_connectivity_is_very_slow
Sent using a virtual keyboard on a phone
… On Aug 25, 2022, at 08:48, jckefan ***@***.***> wrote:
The tunnel works on MikroTik, but it's just too sloooow! Hardly anything opens!
After some investigation I came up with the following conclusion. It looks like that decryption takes all the power of the mikrotik. Need to have a look for a more expensive model that has decryption cores in it.
Mine (MikroTik HAP AC3) does support hardware accelerated IPsec. CPU utilization barely goes anywhere, it must have something to do with settings. Because I also tried testing VPN with setting up WireGuard peer on the router and tunneling a client's traffic through it, the performance of WireGuard was miles better than IPsec. The only downside of WG is that it isn't HW accelerated.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.
|
I tried it, doesn't help |
|
On Thu, 25 Aug 2022, Maksim Beliaev wrote:
https://libreswan.org/wiki/FAQ#My_ssh_sessions_hang_or_connectivity_is_very_slow
I tried it, doesn't help
Does "cat /proc/net/xfrm_stat" show any non-zero values indicting a problem?
Paul
|
|
Here is the output |
|
On Aug 25, 2022, at 17:34, Maksim Beliaev ***@***.***> wrote:
Here is the output
cat /proc/net/xfrm_stat
XfrmInError 0
XfrmInBufferError 0
XfrmInHdrError 0
XfrmInNoStates 3157
That’s odd. You are receiving packets but don’t have a matching ipsec SA for it.
XfrmInStateProtoError 0
XfrmInStateModeError 0
XfrmInStateSeqError 0
XfrmInStateExpired 0
XfrmInStateMismatch 0
XfrmInStateInvalid 0
XfrmInTmplMismatch 0
XfrmInNoPols 10
And also no policy?
We might need to see a while complete log from startup to problem case to see what’s going on
|
|
But everything is working great on android and iPhone. I am using mikrotik hap lite, which has no hardware acceleration. |
|
@beliaev-maksim On WinBox under Tools open Profile and start to monitoring the CPU usage and see if there are any process eating CPU from VPN sections or encryption/decryption. |
|
disable fasttrack on Mikrotik |
|
And how do I connect 2 or more certificates with different IPs where different servers are installed? |
|
Hi, How do you import *.p12 cert to RouterOS? It seems like it does not work with GUI/cli. I use 7.12.1 and 7.14.1 versios of RouterOS. |
|
Hi, |
|
Hi, |
Man, you saved my weekend. |
Is this enough to add second device to go through VPN? Because it does not work. upd. After disabling/enabling random tabs at IP-IPsec it started working |
|
Help me to understand [admin@MikroTik] > /ip firewall address-list add address=192.168.1.17 list=local I just want send my traffic from TV 192.168.1.17 to YouTube via VPN 194.36.178.191 |
|
Some stranges with IKEv2 tunneling from Mikrotik. If I configure L2TP/IPsec, there are no such problems, but the speed is not very high. IKEv2 mobile client does not have such problems. I've try disable fasttrack firewall rule, but it didn't helps. Has anyone else had problems like this? |
|
The problem described above is related to MTU. The solution can be found by googling mikrotik ikev2 mtu. |
Checklist
Describe the issue
Hello
I'm trying to setup my mikrotik router as client for IKEV2 but I getting (peer's ID does not match certificate) error in my router log.
What is the peer ID that is set in the certificate that needed to be verified?
I imported the default vpnclient.p12 certificate in my router.
I tried setting fqdn to vpnclient & "my server public IP address" and none of them worked and give me same or the "got fatal error: AUTHENTICATION_FAILED" error.
Client (my router) is behind NAT and does not have a static IP address but server is NOT behind NAT and have a static IP address.
Link to IPsec Manual of mikrotik routers if you want to check anything with there inorder to guide me: https://wiki.mikrotik.com/wiki/Manual:IP/IPsec
Server (please complete the following information)
Client (please complete the following information)
The text was updated successfully, but these errors were encountered: