ipsec-policy not working?

RouterOS General
1

Hi all,

I have been troubleshooting this for some time and I need some help. I have RB4011 running RouterOS 7.6 (worked the same in v6). I have a firewall rule:

chain=forward action=accept src-address-list=Office out-interface-list=WAN log=yes ipsec-policy=out,none

The idea was to allow internal traffic to the internet but this rule also allows everybody to access all ipsec tunnels since WAN is the outgoing interface for ipsec as well. I thought ipsec-policy=out,none would prevent that. I know this rule is a culprit because access is denied if this rule is disabled or subnet is taken out of “Office” address list.
Why doesn’t ipsec-policy work in this case? It works for the ingress traffic. Did I miss something or misunderstood the documentation?

I can do it differently, but I would have to add rules and rearange them so basically a complication and I would like to avoit it.

Any help would be appreciated. Thank you!

2

Is there any srcnat involved? Meaning that tunnel wouldn’t be for addresses in Office list but for some other virtual address/subnet and srcnat would change source to that. The ipsec-policy in forward couldn’t work in such case, because srcnat happens only after forward.

3

Hi Sob,

Yes, that it exactly the case. Ipsec tunnels are all being source natted into different subnets and I have a rule in srcnat chain with netmap acction for each of them. NAT networks are not part of Office address list.

Thinking about this I actually don’t know what the best solution for this would be. It would seem that traffic should then not be allowed into the tunnels anyway if the rule that allows it doesn’t include correct subnet. Or on the other hand, the ipsec-policy=out,none should exempt the ipsec traffic no matter what source address is.

4

The problem is that ipsec-policy looks for policy that matches current src/dst address combination, in whatever chain it is. Forward chain sees packets from to , but your policy is for ↔ , so it can’t match and packet is allowed. It gets its source changed to later and it would match existing policy, but then it’s too late.

You can handle it manually:

/ip firewall filter
chain=forward action=accept src-address-list=Office out-interface-list=WAN dst-address-list=!remote_subnets_list

And there’s a good chance that you can be lazy and simply add whole 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 in remote_subnets_list.

5

Hi Sob,

now I get it. I mistakenly though that ipsec-policy means “it is ipsec traffic” not “it matches certain ipsec policy”. Reading the documentation I don’t know why thought that because it clearly states that is has to match one of the policies.
I also tested your solution and it works exactly as it should.

Thanks a lot for clearing that out and also providing a solution.