I have an ipsec vpn which is synced between a Zyxel Flex 200 and an RB5009.
When I’m in the data center where the RB5009 is located, I can log onto the remote office Zyxel router via Web browser (using the ip address of the remote router). And I can RDP
to several of the pc’s on the remote office over the vpn.
BUT
When I go to the remote office, I cannot connect to the RB5009, or any of the data servers in the data center.
Another odd thing is, when I’m in the data center connected to a pc in the remote office via RDP connection, I CAN open a browser and connect back to the RB5009 in the data center.
It is hard to guess which settings are missing if we don’t know which are already present, but the way you describe it, a rule chain=input protocol=ipsec-esp src-address=public.ip.of.zyxel action=accept seems to be missing in /ip firewall filter on the 5009. But since the mutual order of the rules is important, said rule has to be put to a correct place in chain input. If you need help with that, post an anonymized result of /ip firewall filter export.
Thanks for the reply.
It appears I made some assumptions. With the Zyxel device, the firewall has default options allowing IPSEC/tunnel traffic to it’s network. That is why that end
works.
With the RB5009 device, the ipsec setup doesn’t automatically include the firewall filters to allow the traffic to the RB5009 side and devices.
Now the light has turned on.
I’ll add those filters and learn a little more about the firewall model and terminology…and of course test, test, test!