ipv6 firewall input chain match on in interface doesn't seem to work.

RouterOS General
1

Hello all,

Thanks in advance for any help you can give me. I’m running 7.4 code on an RB3011

The last rule before my input chain has a jump to “v6_www_services”
The last rule is a default deny:

add action=jump chain=input comment="Input - Manage RB3 via ipv6" jump-target=v6_www_services log=yes log-prefix=jump-to-v6_www src-address-list=Lanv6

add action=drop chain=input comment="No access to RB3" log=yes log-prefix=v6-deafult-drop-input

If, in the “jump-target” rule I also specify an In. Interface of “ether1_MGMT” the jump rule will get skipped and hit the default deny. The log will actually show the traffic came in on ether1_MGMT. If I remove that match condition it works fine. Anyone seen this before?

If this matters, ether1_MGMT is in the “mgmt” vrf, not the default one.

2

Update:

I have created a case with Mikrotik and they can reproduce the problem. Hopefully a fix is forthcoming :slight_smile:

3

Quick guess, it’s probably related to the funny business with hidden interfaces (see VRF and hidden interfaces). But it’s weird that it would log the right one.