I’ve got a new RouterOS installation, using my default filter settings that is not allowing VPN access. I set up a filter rule (# 6 below) on the input chain to allow access through the PPTP port (1723), but it’s not triggering. Instead it’s falling through to the “drop everything else” rule.
If I disable the “drop everything else” rule, then PPTP access works.
/ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Drop invalid connections
chain=input action=drop connection-state=invalid
1 ;;; Allow established connections
chain=input action=accept connection-state=established
2 ;;; Allow related connections
chain=input action=accept connection-state=related
3 ;;; Allow UDP
chain=input action=accept protocol=udp
4 ;;; Allow ICMP
chain=input action=accept protocol=icmp
5 ;;; Allow incoming on the BACnet port
chain=input action=accept protocol=udp in-interface=ether1 dst-port=47808
6 ;;; Allow incoming for PPTP tunnel
chain=input action=accept connection-state=new protocol=tcp dst-port=1723 connection-type=pptp
7 ;;; Allow input from the private address space
chain=input action=accept src-address-list=private
8 ;;; Log everything about to be dropped
chain=input action=log log-prefix="Drop"
9 ;;; Drop everything else
chain=input action=drop
I’ve tried different variations on rule #6, but nothing seems to trigger.
Anyone know what I’m missing here? ROS version is 4.17, but I also tried 3.13.
PPTP uses two connections: tcp/1723 as a control channel, and a GRE tunnel that carries the actual data. connection-type=pptp matches GRE tunnels that the firewall previously observed being set up via tcp/1723 control channels. The control channel itself, however, will never match that. Because you’re referring to this relationship in your rule it doesn’t match, so the packets drop through to rules further below. Remove the connection-type=pptp from this rule. Your related rule:
2 ;;; Allow related connections
chain=input action=accept connection-state=related
Thanks for the very quick response. I guess I hadn’t tried that variation yet. I did look at another router, where I had it working properly, and sure enough, it didn’t have the PPTP conection-type modifier.
When I dropped that, it started working correctly.