So I have two Hex S routers (7.23.1) The routers are a simple DHCP server for a couple of local 'LAN' IPs and a OpenVPN tunnel to a remote server. Essentially they are just used for making a VOIP connection from a site to a VOIP server but want to route all traffic over the VPN, not just the VOIP …

The rule /routing rule add action=lookup min-prefix=0 table=main has this effect: All the current active routes (with A flag) in the main table will be looked at, except for the route with /0 in the destination (which means except for the routes with dst-address=0.0.0.0/0), if one of those active …

So just to complicate matters....... One of my servers runs openvpn "routed" mode. So we have Server: public IP 1.2.3.4 internal 'network' 192.168.98.0/24 routed 'network' 192.168.29.0/24 The Hex S has an internal network of 192.168.88.0/24 When connected to the OpenVPN server we can browse f…

Can you check under IP -> Firewall -> Service Ports, to see whether the sip helper is enabled? [image] (it should be enabled). If possible, post the /ip firewall export output (to include the other chains too, not only filter). [image] reetp: Got this: Forwards forward: in:bridge out:ovpn,…

[image] CGGXANNX: Can you check under IP -> Firewall -> Service Ports, to see whether the sip helper is enabled? Ha - ironically it wasn't. For an obscure reason I forget in the mists of time I think I either read or was told to disable it. I'll test with it enabled thanks! I have enable a w…

@ CGGXANNX What does Routing / Rule → Chain = Mangle and User do? Have you had any experience using this feature?

Hi @nichky , I have an older post that talks about this: [image] PBR Routing Rules in ROS 7.22 Stable General It has been added since 7.22, not 7.23 slight_smile. To know what those new actions under /routing rule are, you can first read the current documentat…

@CGGXANNX i'm struggling with VRF Let's say I have: 192.168.10.1/24 - ether2 (VRF10) 192.168.20.1/24 - ether4 (main) If I add: /ip/route add dst-address=192.168.20.0/24 gateway=ether4@main routing-table=vrf10 /ip/route add dst-address=192.168.10.0/24 gateway=ether2@vrf10 routing-table=ma…

When 192.168.20.1 is the router's own address in the main VRF, then unfortunately, you cannot access that address from other VRFs with only those simple routes above. You can apply a workaround using a "tunnel" as described in this post: [image] Accessing router-hosted servi…

@CGGXANNX That explanation is amazing, but my setup is a little bit different. I have PPPoE/VPN running in a VRF, and from that VRF im accesing to the router. In the main routing table, I have Yealink phones. What I need is to access the phones from the VRF using a web browser/proxy, by allowing…

If you only need to access the client hosts (not the router itself) in main from other VRFs, then you don't need the complicated setup with the tunnel. Only the normal route leaking like you posted are needed. With what your posted, client 192.168.10.25 plugged to ether2 should be able to connect to…

Route all traffic via VPN (except initial connection)

RouterOS General

CGGXANNX July 11, 2026, 11:30am 10

Hi @nichky, I have an older post that talks about this: