Hi there,
I can’t get traffic from the router (e.g. DNS queries) routed through my VPN connection.
I have a list of IP addresses (VPN_Dest) that are to be accessed through the VPN connection. With the mangle rules below that works fine for all clients on my network but not for the router itself, even though I created a mangle rule on the output chain.
My configuration is as follows:
/ip firewall filter
add action=drop chain=input comment="Drop invalid IPSec connection attempts." \
dst-port=500 protocol=udp src-port=1,7,8,382
add action=add-src-to-address-list address-list=Syn_Flooder \
address-list-timeout=30m chain=input comment="Syn Flood detection" \
connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input comment=\
"Drop connections based on syn flood list" src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
address-list-timeout=1w chain=input comment="Port Scanner detection" \
protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment=\
"Drop connections based on port scanner list" src-address-list=\
Port_Scanner
add action=drop chain=input comment="Drop connections based on bogon list" \
src-address-list=bogons
add action=drop chain=input comment="Drop invalid connections" \
connection-state=invalid
add chain=input comment="Accept established connections" connection-state=\
established
add chain=input comment="Accept related connections" connection-state=related
add chain=input connection-state=new dst-port=500,4500 in-interface=\
Internet protocol=udp src-port=!500,4500
add chain=input dst-port=1701 protocol=udp src-address-list=L2TP_Allowed
add chain=input comment="Accept ICMP from LAN" in-interface=\
ether2-master-local protocol=icmp
add action=drop chain=input in-interface=Internet
add action=drop chain=input in-interface=WAN
add action=drop chain=forward comment="Drop invalid connections" \
connection-state=invalid
add action=fasttrack-connection chain=forward connection-state=\
established,related
add chain=forward comment="Allow Private VPN Networks and Hosts" \
dst-address-list=No_Bogons
add action=drop chain=forward comment="Drop connections based on bogon list" \
dst-address-list=bogons
add chain=forward comment="Accept established connections" connection-state=\
established
add chain=forward comment="Accept related connections" connection-state=\
related
add action=drop chain=forward comment="Drop everything else on forward chain" \
connection-state=new in-interface=Internet
add action=drop chain=forward in-interface=WAN
/ip firewall mangle
add chain=prerouting comment="Accept LAN-to-LAN Traffic" dst-address=\
192.168.88.0/24 src-address=192.168.88.0/24
add action=mark-connection chain=prerouting comment=\
"Mark New Connection for No_VPN" connection-state=new dst-address-list=\
No_VPN new-connection-mark=No_VPN
add chain=prerouting comment=\
"Accept Connections based on Connection Mark No_VPN" connection-mark=\
No_VPN
add action=mark-routing chain=prerouting comment="Source Based Marking." \
new-routing-mark=VPN passthrough=no src-address-list=1_VPN
add action=mark-routing chain=prerouting comment="Destination Based Marking." \
dst-address-list=VPN_Dest new-routing-mark=VPN passthrough=no
add action=mark-routing chain=output comment=\
"Destination Based Marking for Traffic from Router itself." \
dst-address-list=VPN_Dest new-routing-mark=VPN
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade for LAN" src-address=\
192.168.88.0/24 to-addresses=0.0.0.0
/ip route
add distance=1 gateway=VPNGW routing-mark=VPN
When I try to ping an IP address from VPN_Dest from the router, I can see the counter on the mangle rule for the output chain go up. But I still get timeouts…
Your help is really appreciated!
Thanks and kind regards,
iBlueDragon