1

I've set up a VPN between my mikrotik router and Google Cloud Platform VPN.

According to the Green check next to peer IP on the VPN Console, VPN is up, but all pings are timed out.

> /ip ipsec policy print
Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default
 0 T * group=default src-address=::/0 dst-address=::/0 protocol=all
       proposal=default template=yes

 1     src-address=192.168.88.0/24 src-port=any dst-address=10.240.0.0/24
       dst-port=any protocol=all action=encrypt level=require
       ipsec-protocols=esp tunnel=yes sa-src-address=xxx.xxx.xxx.xxx
       sa-dst-address=yyy.yyy.yyy.yyy proposal=default priority=0

where xxx.xxx.xxx.xxx is my router's public ip, and yyy.yyy.yyy.yyy is the IP to VPN server; 192.168.88.0/24 is my home LAN, and 10.240.0.0/24 is remote LAN.

> ping
address: 10.240.0.1
  SEQ HOST                                     SIZE TTL TIME  STATUS
    0 10.240.0.1                                              timeout
    1 10.240.0.1                                              timeout
    2 10.240.0.1                                              timeout
    3 10.240.0.1                                              timeout
    4 10.240.0.1                                              timeout
    5 10.240.0.1                                              timeout
    sent=6 received=0 packet-loss=100%
Quan Zhou
  • 65
  • 1
  • 7
  • You can try to capture some packets using tcpdump or wireshark on your GCE and local machine to see if they are receiving any esp traffic. Moreover, from the packet capture you can also figure out if both sides are receiving the echo request and if the response has been sent to the request. – Faizan Jul 07 '15 at 17:25
  • Can you ping servers inside your GCE network? depending on how you created the network on GCE, the default behavior is not to accept ICMP, in other words you can't ping. Can you ssh the instance from your home? or access any other port? – Noa Jan 12 '16 at 15:44

1 Answers1

1

I figured out that GCE's IPSEC only connects sites, after route table set, you still need a VM instance to do the actual traffic forwarding.

Quan Zhou
  • 65
  • 1
  • 7