I don’t think you can given that IPsec encryption happens after postrouting, and postrouting is the last facility in the IP firewall. You can’t decide in a firewall rule whether or not something is going to match the selectors of the IPsec engine in the next step (other than looking at the selectors of your IPsec policy and dropping it beforehand - but that isn’t an automated “if it didn’t match the policy drop it” process).
I may be thinking about this wrong and someone else may have a solution, but in my opinion the only way to achieve that is to put two routers in sequence at each location. The one closer to the LAN serves as a VPN head end, the one between the VPN head end and the WAN discards all RFC1918 traffic (except for the /30 between the two routers if you’re using private space for that connection) that the head end didn’t encrypt into a packet that now is destined to a public IP. You ideally would be able to route a public IP to the VPN head end, though, rather than NAT it. NAT-T should work but if you can remove it from the scenario you make troubleshooting easier.
I’m running some tests and it seems mangle does detect ipsec-esp protocol in postrouting…
EDIT1: I think you’re right - even though mangle can see the traffic firewall will not dop it…
Yes, the encrypted packets will go through postrouting - but that’s the traffic that got encrypted, and you want to drop everything else (LAN to LAN traffic that didn’t match the IPsec policy to prevent it from leaking to the Internet). Or did I misunderstand the original question?
You understood me right. I should have studied the packet flow before posting (http://wiki.mikrotik.com/wiki/Packet_Flow).
Based on the packet flow I could packet mark all RFC1918 traffic in postrouting than shape it down to 0bps (unless IPSEC packets inherit packet marks from the payload) in WAN interface HTB. What do you think?
Huh, that might work. Marks are not inherited.
Shaping it down in WAN HTB did not work very well as it does not support 0bps rate. However, I did find a solution: bridge filter!