Hello
I’m desperating on the following setup which I’m trying to copy from a SnapGear Firewall who is too slow for the task:
WAN: Connected to the Internet with an IPSEC Tunnel to another site. Default Route Traffic should go through that tunnel.
LAN: VLAN2: One routed network with public IP addresses. No NAT
LAN: VLAN3: Another routed network with public IP addresses. No NAT
Servers on VLAN2 can communicate with the internet via tunnel and vice versa.
Servers on VLAN3 can communicate with the internet via tunnel and vice versa.
Servers on VLAN2 can NOT communicate with Servers on VLAN3 and vice versa.
I digged into the problem and found others describing the same issue, apparently caused by the fact that RouterOS is applying the IPSEC policies before routing instead of after routing like most other firewall appliances do.
So if it sees a packed from VLAN2 directed to VLAN3 the IPSEC policy with the default route applies and RouterOS is encrypting and sending that packet out via the IPSEC tunnel instead of routing it to the VLAN3 Interface where the destination network is attached to and the r$
The suggested solution to create two more policies with action ‘none’ pointing from the Network of VLAN2 to the Network of VLAN3 and vice versa does not work here. One of those policies is always being marked ‘invalid’. But! In the about three seconds before it is marked inv$
So I suppose there is a bug in the code determining that a policy is invalid. (Using RouterOS 6.0rc5).
Does anyone know a work-around or a way to fix that problem? Downgrade to an older release?
PS: It is not a VLAN issue. Id did try with setting up single interfaces for each LAN Network. The Problem ist the same.
-Benoit-