Туннель ipsec на microtik пингуется в одну сторону

[ankamodin]

Есть три офиса А В и С (офис А главный) . На каждой точки интернет провайдер с стат.адресом (роутерЫ MICROTIK RB951U1-2nD ).

Между АиВ, В и С, А и С настроен VPN IPSEC туннель.(на каждой точки белый(стат) ip) Стала необходимо добавить офис (точку D)с доступам ресурсам в гавном корпусе. Был приобретен Mikrotik hEX RB750Gr3 для точки D. Между A и D был настроен ipsec туннель.Вроде все ок, из точки D доступ к ресурсам в А есть. Но

Из точки D пингуется пул ip адресов ЛВС в точке А, а наоборот нет, т.е. из точки А пул ip адресов ЛВС в точки D не пингуется!!!!!! хотя в се правила были сделано по аналогии с ранее поднятыми туннелями. Антивирус касперского в точке D отключал. В какую сторону смотреть?

[Erik_U]

В какую сторону смотреть?

в сторону таблицы маршрутизации

[ankamodin]

а по подробнее, желательно с примерами

[Erik_U]

у нового микротика появилась новая IP сеть в офисе за ним. Нужно, чтобы она не пересекалась с другими IP сетями в других офисах.

И по аналогии с тем, как ку вас уже сделано, нужно в каждом офисе добавить маршрут до новой сети этого нового офиса, а на новом микротике добавить маршруты до всех IP сетей старых офисов.

Выгрузите сюда конфиги ваших микротиков, я вам на них примеры покажу, если сами не можете увидеть.

[ankamodin]

MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK

MikroTik RouterOS 7.24.4 (c) 1999-2026 https://www.mikrotik.com/



Do you want to see the software license? [Y/n]: n

Press F1 for help


(33 messages not shown)
2026-09-24 07:44:29 system,error,critical login failure for user admin from C8:5B:
76:BA:C1:35 via winbox
2026-09-24 07:36:54 system,error,critical router rebooted without proper shutdown,
probably power outage
2026-09-24 07:36:52 system,error,critical router rebooted without proper shutdown,
probably power outage
2026-09-24 07:36:52 system,error,critical router rebooted without proper shutdown,
probably power outage
2026-09-24 07:36:53 system,error,critical router rebooted without proper shutdown,
probably power outage
2026-09-24 07:36:53 system,error,critical router rebooted without proper shutdown,
probably power outage
2026-09-24 07:36:53 system,error,critical router rebooted without proper shutdown,
probably power outage
2026-10-06 06:47:58 system,critical,info cloud change time Sep/24/2026 07:37:23 =>
Oct/06/2026 06:47:58

expected command name (line 1 column 1)
[rootom@hEX] > /export
# 2026-10-09 09:41:25 by RouterOS 7.24.4
# software id = 1HDI-NCUC
#
# model = RB750Gr3
# serial number = HJT0AX65E12
/interface bridge
add admin-mac=04:F4:1C:42:E1:C4 auto-mac=no comment=defconf name=bridge
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1 \
use-peer-dns=yes user=0002023095@moris.ru
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip ipsec profile
add dh-group=modp1024 enc-algorithm=3des,des name=xnn-luchovka nat-traversal=no
/ip ipsec peer
add address=193.150.x.x/32 local-address=85.95.xx.xx name=xnn-luchovka \
profile=xnn-luchovka
/ip ipsec proposal
add enc-algorithms=des name=xnn-luchovka pfs-group=none
/ip pool
add name=dhcp ranges=192.168.10.100-192.168.10.254
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge disabled=yes interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-out1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.10.250/24 interface=bridge network=192.168.10.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1 name=ether1
/ip dhcp-server
add address-pool=dhcp disabled=yes interface=bridge name=defconf
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=192.168.10.250 gateway=192.168.10.250 \
netmask=24
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.10.250 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
out,none out-interface-list=WAN
add action=accept chain=srcnat dst-address=192.168.5.0/24 src-address=\
192.168.10.0/24
add action=dst-nat chain=dstnat dst-address=85.95.xx.xx dst-port=36912 \
protocol=tcp to-addresses=192.168.10.100 to-ports=36912
add action=dst-nat chain=dstnat dst-address=85.95.xx.xx dst-port=78 protocol=\
tcp to-addresses=192.168.10.100 to-ports=78
/ip ipsec identity
add peer=xnn-luchovka
/ip ipsec policy
add dst-address=192.168.5.0/24 peer=xnn-luchovka proposal=xnn-luchovka \
src-address=192.168.10.0/24 tunnel=yes
/ip route
add disabled=yes dst-address=0.0.0.0/0 gateway=85.95.xxx.xxx
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" \
src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" \
dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Moscow
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
[rootom@hEX] >
[rootom@hEX] >

[Erik_U]

Это поясните:

Код: Выделить всё

/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.5.0/24 src-address=\
192.168.10.0/24