On the hEX S router, after updating the firmware from version 6.49.10 to version 7, access to some hosts via ipsec lan-to-lan stopped working.
The firewall and NAT configuration were not changed. I tried twice (downgrade, upgrade) with no changes.
Where to look for a solution?
On this forum 
Can you please share your V7 config:
/export file=anynameyoulike
Remove serial and any other private information. And please place the output between code tags, that is the </> button.
connection from any VPN does not work, e.g. to the address 192.168.24.2
# 2023-11-22 10:54:19 by RouterOS 7.12
# software id = P41T-C5T8
#
# model = RB760iGS
# serial number = </>
/interface bridge
add admin-mac=aa:bb:cc:00:11:22 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=ether1_gateway
set [ find default-name=ether2 ] name=ether2_fibaro
set [ find default-name=ether3 ] name=ether3_octagon
set [ find default-name=ether4 ] name=ether4_salus
set [ find default-name=ether5 ] name=ether5_ubiquti poe-out=off
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1_gateway name=pppoe-out1 \
use-peer-dns=yes user=</>
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip firewall layer7-protocol
add name=youtube regexp=\
"^..+\\.(youtube.com|googlevideo.com|akamaihd.net).*\$"
add name=google regexp="^..+\\.(google.com|poki.pl).*\$"
add name=facebook regexp="^.+(facebook.com).*\$"
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip ipsec profile
add dh-group=modp4096,modp3072 enc-algorithm=aes-192,aes-128 hash-algorithm=\
sha256 name=ipsec_1_F1
add name=ipsec_3_F1
add dh-group="ecp256,ecp384,ecp521,modp8192,modp6144,modp4096,modp3072,modp204\
8,modp1536,modp1024,modp768" enc-algorithm=\
aes-256,aes-192,aes-128,3des,des name=ipsec_2_F1
add dh-group="ecp256,ecp384,ecp521,modp8192,modp6144,modp4096,modp3072,modp204\
8,modp1536,modp1024,modp768" enc-algorithm=\
aes-256,aes-192,aes-128,3des,des name=ipsec_4_F1
add dh-group=modp4096,modp3072 enc-algorithm=aes-256 name=ipsec_5_F1_lan2
/ip ipsec peer
add address=13.13.13.13/32 exchange-mode=ike2 name=ipsec_4__peer \
profile=ipsec_4_F1
add address=23.23.23.23/32 exchange-mode=ike2 name=ipsec_1__peer profile=ipsec_1_F1
add address=33.33.33.33/32 exchange-mode=ike2 name=ipsec_5__peer_lan2 profile=\
ipsec_5_F1_lan2
add address=43.43.43.43/32 exchange-mode=ike2 name=ipsec_3__peer profile=\
ipsec_3_F1
add address=53.53.53.53/32 exchange-mode=ike2 name=ipsec_2__peer profile=\
ipsec_2_F1
/ip ipsec proposal
add auth-algorithms=sha512 enc-algorithms=aes-256-cbc,aes-192-cbc lifetime=\
12h30m name=ipsec_1_F2 pfs-group=modp4096
add auth-algorithms=sha512,sha256,sha1,md5,null enc-algorithms="aes-256-cbc,ae\
s-256-ctr,aes-256-gcm,camellia-256,aes-192-cbc,aes-192-ctr,aes-192-gcm,cam\
ellia-192,aes-128-cbc,aes-128-ctr,aes-128-gcm,camellia-128,3des,blowfish,t\
wofish,des,null" name=ipsec_3_F2 pfs-group=none
add auth-algorithms=sha512,sha256,sha1,md5,null enc-algorithms="aes-256-cbc,ae\
s-256-ctr,aes-256-gcm,camellia-256,aes-192-cbc,aes-192-ctr,aes-192-gcm,cam\
ellia-192,aes-128-cbc,aes-128-ctr,aes-128-gcm,camellia-128,3des,blowfish,t\
wofish,des,null" name=ipsec_4_F2 pfs-group=none
add auth-algorithms=sha512,sha256 enc-algorithms=\
aes-256-ctr,aes-192-ctr,aes-128-gcm name=ipsec_5_F2_lan2 pfs-group=modp4096
add auth-algorithms=sha512,sha256,sha1,md5,null enc-algorithms="aes-256-cbc,ae\
s-256-ctr,aes-256-gcm,camellia-256,aes-192-cbc,aes-192-ctr,aes-192-gcm,cam\
ellia-192,aes-128-cbc,aes-128-ctr,aes-128-gcm,camellia-128,3des,twofish,de\
s,null" name=ipsec_2_F2 pfs-group=none
/ip pool
add name=default-dhcp ranges=192.168.24.2-192.168.24.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge lease-time=1d name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf interface=ether2_fibaro
add bridge=bridge comment=defconf interface=ether3_octagon
add bridge=bridge comment=defconf interface=ether4_salus
add bridge=bridge comment=defconf interface=ether5_ubiquti
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1_gateway list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.24.1/24 comment=defconf interface=bridge network=\
192.168.24.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1_gateway
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.24.1 comment=defconf name=router.lan
/ip firewall filter
add action=reject chain=forward comment=facebook connection-mark=\
facebook_conn disabled=yes dst-address=192.168.24.9 layer7-protocol=\
facebook protocol=tcp reject-with=tcp-reset
add action=drop chain=forward comment="block 443 komp" disabled=yes \
dst-port=443 protocol=tcp src-address=192.168.24.9
add action=drop chain=forward comment="block 443 iPad" disabled=yes dst-port=\
443 protocol=tcp src-address=192.168.24.15
add action=reject chain=forward comment="Block Youtube" connection-mark=\
youtube_conn disabled=yes dst-address=192.168.24.9 protocol=tcp \
reject-with=tcp-reset time=16h15m-23h30m,sun,mon,tue,wed,thu,fri,sat
add action=reject chain=forward comment="Block Youtube" connection-mark=\
youtube_conn disabled=yes dst-address=192.168.24.15 protocol=tcp \
reject-with=tcp-reset time=15h15m-23h30m,sun,mon,tue,wed,thu,fri,sat
add action=reject chain=forward comment="Block Google" connection-mark=\
google_conn disabled=yes dst-address=192.168.24.9 protocol=tcp \
reject-with=tcp-reset time=6h-19h30m,sun,mon,tue,wed,thu,fri,sat
add action=drop chain=forward disabled=yes
add action=drop chain=forward disabled=yes dst-address=192.168.24.9 dst-port=\
"" layer7-protocol=youtube protocol=tcp src-port=80,443
add action=accept chain=forward log=yes log-prefix=roomba src-address=\
192.168.24.13
add action=drop chain=forward disabled=yes src-address=192.168.24.24
add action=drop chain=forward disabled=yes src-address=192.168.24.27
add action=drop chain=forward disabled=yes src-address=192.168.24.29
add action=drop chain=forward disabled=yes src-address=192.168.24.33
add action=drop chain=input disabled=yes dst-address=192.168.24.1 \
src-address=10.0.0.0/24
add action=drop chain=input disabled=yes dst-address=192.168.24.1 \
src-address=192.168.8.0/24
add action=accept chain=input dst-address=192.168.24.0/24 src-address=\
192.168.3.4
add action=drop chain=input connection-state=established,related disabled=yes \
dst-address=192.168.24.1 src-address=192.168.3.0/24
add action=accept chain=input dst-port=21 protocol=tcp src-address=\
192.169.1.99
add action=drop chain=input dst-port=21 in-interface=ether1_gateway protocol=\
tcp
add action=accept chain=input dst-port=22 in-interface=ether1_gateway protocol=\
tcp src-address=192.169.1.99
add action=drop chain=input dst-port=22 in-interface=ether1_gateway protocol=\
tcp
add action=drop chain=input dst-port=80 in-interface=ether1_gateway protocol=\
tcp
add action=accept chain=input dst-port=8291 protocol=tcp src-address=\
192.168.1.99
add action=drop chain=input dst-port=8291 in-interface=ether1_gateway protocol=\
tcp
add action=drop chain=forward disabled=yes src-address=192.168.3.0/24 \
src-address-list=""
add action=drop chain=forward disabled=yes src-address=10.0.0.0/24
add action=drop chain=forward connection-state="" disabled=yes src-address=\
192.168.8.0/24
add action=drop chain=forward connection-state="" disabled=yes src-address=\
172.17.17.0/24
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
"defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=accept chain=srcnat dst-address=192.168.1.0/24 src-address=\
192.168.24.0/24
add action=accept chain=srcnat dst-address=192.168.2.0/23 src-address=\
192.168.24.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec identity
add peer=ipsec_4__peer
add peer=ipsec_1__peer
add peer=ipsec_5__peer_lan2
add peer=ipsec_3__peer
add peer=ipsec_2__peer
/ip ipsec policy
add dst-address=192.168.1.0/24 peer=ipsec_1__peer proposal=ipsec_1_F2 src-address=\
192.168.24.0/24 tunnel=yes
add dst-address=172.17.17.0/24 peer=ipsec_2__peer proposal=ipsec_2_F2 \
src-address=192.168.24.0/24 tunnel=yes
add dst-address=10.0.0.0/24 peer=ipsec_3__peer proposal=ipsec_3_F2 \
src-address=192.168.24.0/24 tunnel=yes
add dst-address=192.168.8.0/24 peer=ipsec_4__peer proposal=\
ipsec_4_F2 src-address=192.168.24.0/24 tunnel=yes
add dst-address=192.168.2.0/23 peer=ipsec_5__peer_lan2 proposal=ipsec_5_F2_lan2 \
src-address=192.168.24.0/24 tunnel=yes
add disabled=yes dst-address=192.168.1.0/24 peer=ipsec_1__peer proposal=ipsec_1_F2 \
src-address=192.168.24.0/24 tunnel=yes
add disabled=yes dst-address=172.17.17.0/24 peer=ipsec_2__peer proposal=\
ipsec_2_F2 src-address=192.168.24.0/24 tunnel=yes
add disabled=yes dst-address=10.0.0.0/24 peer=ipsec_3__peer proposal=\
ipsec_3_F2 src-address=192.168.24.0/24 tunnel=yes
add disabled=yes dst-address=192.168.8.0/24 peer=ipsec_4__peer proposal=\
ipsec_4_F2 src-address=192.168.24.0/24 tunnel=yes
add disabled=yes dst-address=192.168.2.0/23 peer=ipsec_5__peer_lan2 proposal=\
ipsec_5_F2_lan2 src-address=192.168.24.0/24 tunnel=yes
/ip route
add disabled=no distance=1 dst-address=192.168.1.0/24 gateway=bridge \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add disabled=no distance=1 dst-address=192.168.8.0/24 gateway=bridge \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add disabled=no distance=1 dst-address=192.168.2.0/23 gateway=bridge \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add disabled=no distance=1 dst-address=172.17.17.0/24 gateway=bridge \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
add disabled=no distance=1 dst-address=10.0.0.1/24 gateway=bridge pref-src="" \
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp address=192.168.24.0/24,192.168.1.99/32
set www address=192.168.24.0/24
set ssh address=192.168.24.0/24
set api disabled=yes
set winbox address=192.168.24.0/24,192.168.1.99/32
set api-ssl disabled=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
33434-33534 protocol=udp
add action=accept chain=input comment=\
"defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=input comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
add action=accept chain=forward comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
"defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
ipsec-esp
add action=accept chain=forward comment=\
"defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
"defconf: drop everything else not coming from LAN" in-interface-list=\
!LAN
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=MikroTik
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN