How to make the routing table have higher priority than IPsec Policy?

RouterOS General
1

Theoretically it should be like that, but…
I have an IPsec policy

/ip ipsec policy
dst-address=0.0.0.0/0 level=unique peer=Peer1 proposal=hardware-AEAD src-address=132.40.266.0/28 tunnel=yes

And routing table:

#     DST-ADDRESS        GATEWAY                          DISTANCE
  DAo 0.0.0.0/0          172.17.0.6                             10
  DAc 192.168.5.0/24     ether3                                  0
  DAc 192.168.1.0/24     bridge1                                 0
  DAc 132.40.266.0/28    vlan11-virtual_machines               110
  (...)
0  As 0.0.0.0/0          172.17.0.50                           110

And when I want to get 132.40.266.0/28 from local machine 192.168.1.0/24 it is not possible, because packets are probably encapsulated and encrypted by IPsec.

I would like to make

/ip ipsec policy
dst-address=!192.168.1.0/24 level=unique peer=Peer1 proposal=hardware-AEAD src-address=132.40.266.0/28 tunnel=yes

but for current RouterOS is not possible.

Do you know how to solve it differently?

2

You cannot prevent IPsec from overriding the results of the “normal” routing, but you can exempt some traffic from getting encrypted using an action=none policy. The policies are inspected top to bottom until first match, same like firewall rules or routing rules.

/ip ipsec policy
dst-address=192.168.1.0/24 src-address=132.40.266.0/28 action=none
dst-address=0.0.0.0/0 level=unique peer=Peer1 proposal=hardware-AEAD src-address=132.40.266.0/28 tunnel=yes
3

Thank you very much. :smiley: You are awesome!