Good morning, I have a network with 6 locations. the offices communicate with each other in the following way:
- Wireguard, gre tunnel and sstp. the subnets of the various sites are:
Site1:
LAN 192.168.1.0/24
WG–>site2=172.18.12.1/30
WG–>site3=172.18.13.1/30
WG–>site4=172.18.14.1/30
WG–>site5=172.18.15.1/30
WG–>site6=172.18.16.1/30
gre–>site2=172.16.12.1/30
gre–>site3=172.16.13.1/30
gre–>site4=172.16.14.1/30
gre–>site5=172.16.15.1/30
gre–>site6=172.16.16.1/30
sstp–>site2=172.17.12.1/30
sstp–>site3=172.17.13.1/30
sstp–>site4=172.17.14.1/30
sstp–>site5=172.17.15.1/30
sstp–>site6=172.17.16.1/30
Each location has two WANs. Wireguard and gre do peer to peer using a ddns (so it works with both wans).
SSTP is exposed in the site1 server only on WAN2 and each site in turn uses WAN2 to connect. This is so that if WAN1 falls on any site, sstp remains connected to WAN2 avoiding packet losses due to ddns update times.
All locations use OSPF and in addition to what has already been indicated there is also a wireguard from site3 to site6. I would like each location to announce its LAN with passive broadcasts, but anyway. having the point-to-point interfaces configured as nbma with static neighbors, for example I find myself on site2, a route with dst 172.16.13.0/30 which is the transport between headquarters1 and headquarters3 and its presence would not be essential. How do I filter it? I tried as follows but to no avail.
/routing filter rule
add chain=ospf-out disabled=no rule="if (dst in 172.16.12.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.17.12.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.18.12.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.16.13.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.17.13.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.18.13.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.16.14.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.17.14.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.18.14.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.16.15.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.17.15.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.18.15.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.16.16.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.17.16.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.18.16.0/30) { reject; }"
add chain=ospf-out disabled=no rule="if (dst in 172.18.36.0/30) { reject; }"
add chain=ospf-out disabled=no rule="accept;"