VPN between two providers

Posted January 28, 2018 4.4k views

I have a problem with , I believe , routing on DO Servers.

I manage to connect to servers. One from DO and second from UpCloud with RouterOS on those servers. (I have customized OS on those server to use CHR Mikrotik).

Connected two servers (CHR) with L2TP/IPsec and I have a problem.

Server from UpCloud can ping Mikrotik CHR on DigitalOcean but…
Server from DigitalOcean can’t ping Mikrotik CHR on UpCloud

Routing table on Droplet looks strange after adding entry to UpCloud Network where UpCloud Mikrotik is located with all other servers (I have masked public addresses with x)

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface         xx.xx.xx.xx         UG        0 0          0 eth0   UG        0 0          0 eth1     U         0 0          0 eth0     U         0 0          0 eth1
xx.xx.xx.xx   U         0 0          0 eth0 - this is the IP of the DigitalOcean Mikrotik CHR Droplet
and is network on the other side - the UpCloud Network.
ping obviously gave me 100% lost packets but traceroute looks strange

traceroute to (, 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  *
30 * * * is the IP of the UpCloud Mikrotik CHR Router
There should be on the first hop

  1. which is the DigitalOcean Mikrotik CHR Droplet.

I believe there is problem with Routing Table on that Droplet

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Submit an Answer
2 answers

It’s definitely a routing/firewall issue. What does “ip route show table all” produce? Also, have a peak at some of the “/proc/net/” files with cat. Did you try a tcpdump to see if IPSec routes are actually being applied at run time? Also, what’s your iptables looking like?

DigitalOcean already gave answer for that. It’s impossible. First IP spoofing is enabled so I can add routing between those to providers. Each time when a Server on side B want’s to get to any server through his VPN Gateway Server B to => VPN Gateway Server A (DigitalOcean) and then to the host in the same DataCenter it can’t.