Subnet to Subnet marked as invalid

TvdN · February 6, 2019, 9:26am

Hi!

My situation:

Firewall:

/ip firewall address-list
add address=172.20.24.0/22 list="ESB LAN"
add address=10.32.0.0/20 list=OSG
add address=10.101.0.0/20 list=OSG-SAP-NET
add address=192.9.0.0/16 list="OSG 192.9.0.0"
add address=172.20.16.0/24 list="ADM LAN"
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes protocol=icmp
add action=drop chain=input comment="Drop WAN input" in-interface-list=WAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="ADM LAN -> ESB LAN Allow" connection-state="" dst-address-list="ESB LAN" src-address-list="ADM LAN"
add action=accept chain=forward comment="ADM LAN -> OSG Allow" dst-address-list=OSG src-address-list="ADM LAN"
add action=accept chain=forward comment="ADM LAN -> OSG-SAP-NET Allow" dst-address-list=OSG-SAP-NET src-address-list="ADM LAN"
add action=accept chain=forward comment="ADM LAN -> OSG 192 Allow" dst-address-list="OSG 192.9.0.0" src-address-list="ADM LAN"
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment=VOICE in-interface=VLAN-Voice
add action=drop chain=input in-interface=VLAN-Voice
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

Static Routes:

/ip route
add comment=OSG distance=1 dst-address=10.32.0.0/20 gateway=172.20.16.1
add comment=OSG-SAP-NET distance=1 dst-address=10.101.0.0/20 gateway=172.20.16.1
add comment="ESB LAN" distance=1 dst-address=172.20.24.0/22 gateway=172.20.16.10
add comment="OSG 192.9.0.0" distance=1 dst-address=192.9.0.0/16 gateway=172.20.16.1

IP Addresses:

/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=172.20.16.254/24 interface=Etherchannel network=172.20.16.0
add address=192.168.10.254/24 interface=VLAN-Voice network=192.168.10.0

I want to understand why without adding these firewall rules:

add action=accept chain=forward comment="ADM LAN -> ESB LAN Allow" connection-state="" dst-address-list="ESB LAN" src-address-list="ADM LAN"
add action=accept chain=forward comment="ADM LAN -> OSG Allow" dst-address-list=OSG src-address-list="ADM LAN"
add action=accept chain=forward comment="ADM LAN -> OSG-SAP-NET Allow" dst-address-list=OSG-SAP-NET src-address-list="ADM LAN"
add action=accept chain=forward comment="ADM LAN -> OSG 192 Allow" dst-address-list="OSG 192.9.0.0" src-address-list="ADM LAN"

traffic to these subnets coming from the “ADM LAN” subnet are marked as invalid and discarded by the rule

add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

?

So just to be clear; by adding those allow rules everything works, but I just want to understand why I need to add these

tdw · February 6, 2019, 12:19pm

Forwarding a packet out of the interface on which it is received is considered invalid. You have to explicitly allow traffic which does this, typically for asymmetric routing as in your case, also for some multinetted and VRRP configurations as well.

TvdN · February 6, 2019, 12:35pm

Thanks a lot! This makes sense indeed.

sebastia · February 6, 2019, 12:49pm

Connection-state is related to connection tracking functionality: order of packets in context of a connection. It is not related to how traffic is routed.
See wiki https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Properties

invalid - a packet that does not have determined state in connection tracking (usually - severe out-of-order packets, packets with wrong sequence/ack number, or in case of resource overusage on router), for this reason invalid packet will not participate in NAT (as only connection-state=new packets do), and will still contain original source IP address when routed. We strongly suggest to drop all connection-state=invalid packets in firewall filter forward and input chains

The explanation given is related to reverse path filter setting in /ip settings.

Cause: the traffic is forwarded to another router on same network (gateway=172.20.16.1 on ADM LAN), without any natting, the responses are sent directly to src ip and don’t pass through this router. Connection-state isn’t updated as result, and subsequent “established” packets are labelled as invalid because according to state known on router, connections haven’t been established yet.
Accepting traffic solves that issue. Another option would be to disable connection tracking for them in RAW table.