How to set up connection to servers on aruba in Mikrotik vpn?

Question

VPN

Good day.
For obvious reasons, a foreign VPN was needed. I paid attention to the aruba service.
I set everything up according to the manual - https://www.iphones.ru/iNotes/799076
It connects from Windows, traffic goes through the Czech Republic. Everything is great.
Since everything works, I decided to transfer the VPN connection to the shoulders of the RB951G-2HnD router.
The router has an address of 192.168.1.1
An L2TP Client connection is created in the Interface. Specified the server, login, password, ipsec. Add Default Route enabled/disabled. Judging by the status, the connection is being established, but the traffic is still passing by.
I add a rule to NAT

action=masquerade chain=srcnat out-interface=l2tp-out1

. Just in case, I put the rule first. Still no activity.

And I just can’t figure out how to let all traffic (for starters) through the VPN. In the future, if only certain addresses would be opened via VPN. Maybe the instructions for raising the VPN need another one? For example, you need to raise OpenVPN Server or something else...

Answer 1

I don't understand why the solution from Maxim didn't work.
I did a little different actions (an article on the Internet) and it worked
Add an IP that needs to be passed through the tunnel
/ip firewall address-list add address=178.63.151.224 list=vpn
Add NAT through a vpn connection, add another default route through the l2tp interface -out1 (name of your connection) for vpn marked packets and specify the rule for marking these packets for IP addresses from the vpn list:
/ip firewall nat add action=masquerade chain=srcnat out-interface=vpn-usa
/ip firewall mangle add action =mark-routing chain=prerouting dst-address-list=vpn new-routing-mark=vpn passthrough=no
/ip route add dst-address=0.0.0.0/0 gateway= l2tp-out1 routing-mark=vpn

Answer 2

tools-ping - from there, see if the channel is working or not
, and also as an option 0.0.0.0/0 eth1 distance 2 set (well, this is not 100%)

Answer 3

See the article https://habr.com/post/337426/
Good comment from AcidVenom 09/10/17 at 23:36
This marks the connection
/ip firewall mangle add chain=prerouting src-address=192.168.0.0/24 dst-address-list =AnotherGWList action=mark-routing new-routing-mark=AnotherGWRoute
This is the route for tagged
/ip route add distance=1 routing-mark=AnotherGWRoute gateway=*your_GW*
Well, this is the resource to be routed through the desired gateway.
/ip firewall address-list add address=linkedin.com list=AnotherGWList
Next, simply add the desired resource to the address lists named AnotherGWList.