Mikrotik / Routeros wrap some ip through openvpn - why doesn't routing work?

Question

openvpn

There is a server on debian:

mode server
topology subnet
proto tcp-server
verb 3
local xxxxxxxxx
mssfix
passtos
#comp-lzo yes
comp-noadapt
mssfix
tun-mtu 1500
#fragment 1460
sndbuf 393216
rcvbuf 393216
push "sndbuf 393216"
push "rcvbuf 393216"
push "dhcp-option DNS 8.8.8.8"
user nobody
group nogroup
duplicate-cn
cipher AES-256-CBC
keysize 256
tls-server
persist-key
persist-tun
persist-local-ip
persist-remote-ip
client-to-client
keepalive 5 40

ca /etc/openvpn/keys/ca.crt
dh /etc/openvpn/keys/dh1024.pem
key /etc/openvpn/keys/server.key
cert /etc/openvpn/keys/server.crt

dev tap
lport 1194
push "route-gateway 10.100.200.1"
#push "redirect-gateway def1 bypass-dhcp"
ifconfig 10.100.200.1 255.255.255.0
ifconfig-pool 10.100.200.2 10.100.200.254 255.255.255.0
log-append /var/log/openvpn_server.log

lifted openvpn-client to it in Mikrotik:


everything connected perfectly, threw it into the routes:


8.8.8.8 registered there for the test just to wrap it through vpn.

from the Mikrotik itself, the traceroute goes to 8.8.8.8 as it should:


But from the client of this Mikrotik, it just disappears ping to 8.8.8.8 when you register the route on Mikrotik.

It looks like I messed up something in the firewall or forgot to add something. It is necessary that all clients can access certain ip through openvpn.



ether1 is WAN, ether2 LAN



It seems that everything has shown with regard to the config, if you need something else to understand the situation - write.

Answer 1

Would you like one more src-nat rule, for openvpn ( similar to ether1 )

to certain ip

Here you need to make an adress list, push your IPs there, then in the mangle rules, in the pre-routing chain , make a rule that if someone taps on an address from the list, mark this connection, then drive it to the route.

Answer 2

https://linkmeup.ru/blog/14.html