Hi everybody!
i have 2 mikrotik devices RP433GL (RouterOS 6.34.3) and try to connetc 2 LANs behind them via IPSEC.
So i configured GRE Tunnel over IPSec and everything is ok, LANs “see” each other.
LAN1 ehter2 Mikr1 ether1 10.1.1.1 <------GRE over IPSec------> 10.1.1.2 ether1 Mikr2 ehter2 LAN2
I am confused while trying to configure firewall rules.
why ipsec and gre traffic matches “connection-state=established” input chain?
my firewall rules
/ip firewall filter
add chain=input dst-port=8291 in-interface=ether2 protocol=tcp
add chain=input comment=IPSEC disabled=yes dst-address=10.1.1.1
in-interface=ether1 protocol=ipsec-esp src-address=10.1.1.2
add chain=input disabled=yes dst-address=10.1.1.1 dst-port=500 in-interface=
ether1 protocol=udp src-address=10.1.1.2
add chain=input comment=GRE disabled=yes dst-address=10.1.1.1 in-interface=
ether1 protocol=gre src-address=10.1.1.2
add chain=forward comment=LAN_to_LAN dst-address=10.20.90.0/24 in-interface=
gre-tunnel out-interface=ether2 src-address=10.20.190.0/24
add chain=forward dst-address=10.20.190.0/24 in-interface=ether2 out-interface=
gre-tunnel src-address=10.20.90.0/24
add chain=input comment=established connection-state=established
add chain=forward comment=established connection-state=established
add action=drop chain=input
add action=drop chain=forward