Forward rules ignored over VPN

RouterOS General
1

I’m currently trying to figure out why my user can reach LAN devices from VPN when it’s not really supposed to.

Here are the filter rules I’m using:

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="L2TP VPN" dst-port=1701,500,4500 protocol=udp
add action=accept chain=input comment=IPSec protocol=ipsec-esp
add action=accept chain=input comment="Accept access to Router from VPN" in-interface-list=VPN-Admin protocol=tcp
add action=accept chain=input in-interface-list=VPN-RDP protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked log-prefix=forward_all_
add action=accept chain=forward connection-state=new in-interface-list=VPN-RDP log-prefix=forward_vpn_
add action=accept chain=forward dst-port=3389,53,80,443 in-interface-list=VPN-RDP log=yes log-prefix=rdp protocol=tcp
add action=accept chain=forward dst-port=53 in-interface-list=VPN-RDP protocol=udp
add action=accept chain=input disabled=yes protocol=tcp src-address=192.168.3.0/24
add action=accept chain=forward disabled=yes src-address=192.168.2.0/24
add action=accept chain=input disabled=yes src-address=192.168.2.0/24
add action=accept chain=input disabled=yes in-interface=bridgeguest src-address=192.168.43.0/24
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop from Guest to Corp Network" dst-address=192.168.10.0/24 src-address=192.168.43.0/24
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

When my user connects through VPN, the connection interface is added to the “VPN-Admin” list. In accordance with the filtering rules, through this connection, my user should have access to the router (input chain accepted) but not to other parts of the LAN.

Since I can rule out everything else, my assumption is that this default rule is the culprit.

add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec

I tried to read the manual and various forum posts about this but I’m still not sure I understand this rule properly. Does it mean that every request coming from a VPN connection is going to be allowed to reach any other device in the local net?

Even though it may not be entirely clear from the filter rules above, since they have an error, what I’m trying to achieve is that my user, who is connecting through a VPN interface in the list “VPN-Admin” should have full input and forwarding access. Users connecting through an interface that is part of the list “VPN-RDP” should only be allowed to access RDP, DNS, http and https.

Your help in achieving this correctly is much appreciated.

2

If you use IKEv2, you can limit access by narrowing traffic selectors, that will control at IPsec level, what destination addresses in your LAN can be carried over. I’d assume that currently you allow everything via the 0.0.0.0 selector.

As for firewall, indeed you want to put drop/reject rules before you accept all ipsec traffic in the forward chain. You may be able to use src address matcher in addition to the policy matcher.

3

When you are use PPP Servers (I assume you are using this because you are writing about the VPN interface) then you can use Incoming Filter (Access-List) in PPP Profile. This option works but first you have to push PPP session to PPP Jump chain (from MT WIKI - https://help.mikrotik.com/docs/display/ROS/PPP+AAA#PPPAAA-UserProfiles : incoming-filter - ‘Firewall chain name for incoming packets. Specified chain gets control for each packet coming from the client. The ppp chain should be manually added and rules with action=jump jump-target=ppp should be added to other relevant chains in order for this feature to work’).
Solution for you is showed on this presentation - https://mbum.pl/archive/mbum5/Profilowanie%20Sesji%20VPN.pdf (on the page - ‘Konfiguracja Firewall – PPP Jump rule !’ , sorry but is available only Polish )