*Information on this page was taken directly from http://wiki.mikrotik.com/wiki/Manual:IP/IPsec.  We did not create this document and do not take responsibility for any possible outcome of using these directions.

Site to Site IpSec Tunnel

Consider setup as illustrated below

Two remote office routers are connected to internet and office workstations behind routers are NATed. Each office has its own local subnet, 10.1.202.0/24 for Office1 and 10.1.101.0/24 for Office2. Both remote offices needs secure tunnel to local networks behind routers.

IP Connectivity

On both routers ether1 is used as wan port and ether2 is used to connect workstations. Also NAT rules are set tu masquerade local networks.

Office1 router:

/ip address
add address=192.168.90.1/24 interface=ether1
add address=10.1.202.1/24 interface=ether2

/ip route 
add gateway=192.168.90.254

/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade

Office2 router:

/ip address
add address=192.168.80.1/24 interface=ether1
add address=10.1.101.1/24 interface=ether2

/ip route 
add gateway=192.168.80.254

/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade

IpSec Peer's config

Next step is to add peer's configuration. We need to specify peers address and port and pre-shared-key. Other parameters are left to default values.

Office1 router:

/ip ipsec peer
add address=192.168.80.1/32 port=500 auth-method=pre-shared-key secret="test"

Office2 router:

/ip ipsec peer
add address=192.168.90.1/32 port=500 auth-method=pre-shared-key secret="test"

Policy and proposal

It is important that proposed authentication and encryption algorithms match on both routers. In this example we can use predefined "default" proposal

[admin@MikroTik] /ip ipsec proposal> print 
Flags: X - disabled 
 0   name="default" auth-algorithms=sha1 enc-algorithms=3des lifetime=30m 
     pfs-group=modp1024 

As we already have proposal as a next step we need correct IpSec policy. We want to encrypt traffic coming form 10.1.202.0/24 to 10.1.101.0/24 and vice versa.

Office1 router:

/ip ipsec policy
add src-address=10.1.202.0/24 src-port=any dst-address=10.1.101.0/24 dst-port=any \
sa-src-address=192.168.90.1 sa-dst-address=192.168.80.1 \
tunnel=yes action=encrypt proposal=default

Office2 router:

/ip ipsec policy
add src-address=10.1.101.0/24 src-port=any dst-address=10.1.202.0/24 dst-port=any \
sa-src-address=192.168.80.1 sa-dst-address=192.168.90.1 \
tunnel=yes action=encrypt proposal=default

Note that we configured tunnel mode instead of transport, as this is site to site encryption.

NAT Bypass

At this point if you will try to establish IpSec tunnel it will not work, packets will be rejected. This is because both routers have NAT rules that is changing source address after packet is encrypted. Remote router reiceves encrypted packet but is unable to decrypt it because source address do not match address specified in policy configuration. For more information see packet flow ipsec example.

To fix this we need to set up NAT bypass rule.

Office1 router:

/ip firewall nat
add chain=srcnat action=accept  place-before=0 \
 src-address=10.1.202.0/24 dst-address=10.1.101.0/24

Office2 router:

/ip firewall nat
add chain=srcnat action=accept  place-before=0 \
 src-address=10.1.101.0/24 dst-address=10.1.202.0/24

It is very important that bypass rule is placed at the top of all other NAT rules.