Hello,
I wrote this topic yesterday but can’t find my own post, maybe got deleted due to yesterday’s outage.
I recently updated to RouterOS 7.1.
I’m not sure if I even asked the right Q, So should the IKEv2 Client use private IP on WAN? My IKEv2 config is wrong?
So I have to allow UDP 53 on WAN for my 10.10.11.0/24 otherwise IKEv2 Client can not “dig/nslookup” resolve any DNS, although this is not the case for PPPs like L2TP, OPVN, etc…
Ether----------WAN----------Public IP
CHR
Bridge----------LAN---------- 10.10.10.0/24 PPP - 10.10.11.0/24 IKEv2
It’s IPSec, there’s no dedicated interface, so all packets from client seem to be coming directly from internet, i.e. they will match in-interface-list=WAN, same as any other non-VPN traffic from internet. But you can tell them apart using ipsec-policy=in,ipsec.
Did I use the rule correctly? I also removed none IPsec related address from my address list, I have a NAT rule IPsec-policy=out,none | What the IPsec policy will do in my case in NAT?
if you want to allow access only to dns, you should keep dst-port=53 and have one rule for udp and another for tcp
you probably don’t need dst-address-list, because services on router listen on all local addresses anyway, and if policy doesn’t include others, no traffic to them can come
you may not need src-address-list, unless you want to allow only some VPN clients, but block others (= other VPN clients; other traffic from internet is already blocked by ipsec-policy)
In masquerade rule, ipsec-policy=out,none excludes traffic for which there’s existing IPSec policy. If you’d remove it, masquerade would apply same as for any other traffic, so source would change, policy would not longer match, and VPN wouldn’t work.
You can remove in-interface-list=WAN too, because most likely the traffic will be only from WAN anyway. And if by any chance it comes from somewhere else (e.g. when someone would connect to VPN server from LAN), the main thing is that it’s from encrypted and valid VPN connection.
I did and you are correct no problem with the DNS query, This CHR doesn’t have any LAN user only provides VPN with 0.0.0.0/0 subnet. What do you recommend defined in-interface or just leave it?
I’d remove it, because it doesn’t add anything useful. But if you keep it, it doesn’t hurt you either, except wasted microsecond or so, needed to evaluate this condition.
