Ensure GRE is going trough IPsec with Firewall

RouterOS General
1

Hi there,
i am currently strugeling a litte bit.
To get gre working through ipsec i need to add a rule to allow gre from the same source where the ipsec establishes.
So if i understand that right that gre would be open as port from this source?

If i disable those rule gre won’t work any more.

So what is the right way to do this?

2

You’re looking for ipsec-policy matcher. Depending on style of your firewall, either allow GRE packets matching ipsec-policy=in,ipsec or block GRE pacekts matching ipsec-policy=in,none. And similar for outgoing.

3

My Firewall has:

/ ip firewall filter add action=reject chain=output ipsec-policy=out,none protocol=gre

That serves me well.