IPSec Tunnel and Routes

RouterOS General
1

Network A: 192.168.20.0/24
Network B: 192.168.30.0/24
Network C: 192.168.40.0/30
Network A ↔ Router A (192.168.40.1) ↔ (192.168.40.2) Router B ↔ Network B

On both routers we have an RFC required blackhole for private addresses (including 192.168.0.0/16) with metric 100, and default GW with metric 101.

Unfortunately ROS looking the Routes Table first and then check the IPSec Policy. So IPSec doesn’t work in our scenario because the destination networks are blackholed. And we have no methods to exclude a network from the blackhole rule because we cannot create a new routing rule without GW address (what GW on IPSec tunnel?).

So I think that we need any of the following:

  1. IPSec Policy table should have higher priority than Routes Table.
  2. IPSec Policy should create a Route Table record with configurable metric value.
2

No it should not.
Look at packet flow diagram
http://wiki.mikrotik.com/wiki/Manual:Packet_Flow#IPsec_encryption

3

It should not, based on your vision of it. :slight_smile:
How to manage our situation? How to make an exclusion from the routing table for IPSec policy?

4

I suppose you want to allow only encrypted traffic
http://wiki.mikrotik.com/wiki/IPSEC_between_Mikrotik_router_and_a_Shrew_client#Allow_only_encrypted_traffic

5

Use your default GW in your new routing rules (to exclude specific ranges from the blackhole). Any GW that will direct packets out of the interface holding outer-tunnel IP address (from your IPsec policy) should work.

6

Thank you for your answer. It works!