fasttrack breaking ipsec

RouterOS General
1

Hi!

I installed a new router today. It had fasttrack enabled.
among other things I set up a ipsec connection to my home.
It didn’t work properly. icmp did work, ftp did work, telnet to port 22 showed me the message of the ssh deamon.. but I wasn’t able to connect with ssh, nor with telnet, nor getting webserver connections (to my ipsec net).
I tried and tried for hours… till I had the idea to disable fasttrack and booom… everything works as expected.

Anybody else the same problem?

Regards
Patrick

2

What router? os version?

I use SSH through my IPSec tunnel daily and fasttrack hasn’t been an issue. Have you verified that your MTU is correct? I have seen a lot of SSH issues when packets get fragmented.

I will run some tests on my setup and see if I can duplicate your issue.

3

Good hint. I hadn’t set the mtu at all - it has always been correct so far. (1500/1520). But not on this router, when leaving it empty it takes all kind of strange values 1598, and something other.
I corrected that, but this didn’t change my problem. Fasttrack on → nothing reachabel, fasttrack off → everything works as expected. It’s also not only ssh, i.E. a telnet to port 80 of a webserver gave ‘no route to host’ with fasttrack on.

PS: RB750 with Router OS 6.30.1, on my side a 450G with the same version.

4

can you post your filter export?

5

exclude traffic that is captured by IPsec policy (both directions) from fasttrack

Add accept rule for that traffic before fasttrack-connection rule. See if that helps.

6

It is that way (but also tried taking the fasttrack rules to the top, didn’t help.
hiere is the filter export:

/ip firewall filter
add chain=input dst-port=500 protocol=udp
add chain=input src-address-list=swisscable_patrick_ip
add chain=input src-address=192.168.1.0/24
add chain=forward src-address=192.168.1.0/24
add chain=input protocol=icmp
add chain=input protocol=gre
add chain=input dst-port=1723 protocol=tcp
add chain=input dst-port=8291 protocol=tcp
add chain=input src-address-list=www.sirdir.ch
add chain=input comment="default configuration" connection-state=established,related
add action=drop chain=input comment="default configuration" in-interface=Swisscable
add action=fasttrack-connection chain=forward comment="default configuration" connection-state=established,related disabled=yes
add chain=forward comment="default configuration" connection-state=established,related
add action=drop chain=forward comment="default configuration" connection-state=invalid
add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat connection-state=new in-interface=Swisscable

Obviously fasttrack is disabled now.
Another thing that I find remarkable:

add chain=input src-address=192.168.1.0/24
add chain=forward src-address=192.168.1.0/24

On all my other routers, the forward rule was enough to allow access to the whole subnet. On this router, without the input rule I can access the whole subnet minus the router (which has it’s own logic, but…)

Oh, and that:
add action=drop chain=input comment=“default configuration” in-interface=Swisscable
should prob. go to the very bottom. But then, my traffic is already allowed further up, so prob. it doesn’t makt a difference. But I’ll try that right away.
Oh the otherhand this is the default:

 0  D ;;; special dummy rule to show fasttrack counters
      chain=forward 

 1    ;;; default configuration
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 2    ;;; default configuration
      chain=input action=accept connection-state=established,related log=no 
      log-prefix="" 

 3    ;;; default configuration
      chain=input action=drop in-interface=ether1-gateway log=no 
      log-prefix="" 

 4    ;;; default configuration
      chain=forward action=fasttrack-connection 
      connection-state=established,related log=no log-prefix="" 

 5    ;;; default configuration
      chain=forward action=accept connection-state=established,related log=no 
      log-prefix="" 

 6    ;;; default configuration
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

 7    ;;; default configuration
      chain=forward action=drop connection-state=new 
      connection-nat-state=!dstnat in-interface=ether1-gateway log=no 
      log-prefix=""

Don’t know what rule 3 is really meant for.