v6.45.1 [stable] is released!

Announcements
334

Hi Colleagues,

After reading the whole topic and testing using my own prod :wink: (“CRS326-24G-2S+” < GRE over IKEv2 tunnel > “HAPac”) site it is still unclear for Me which firewall configuration expected to be ‘proper’ since fixing CVE-2014-8160 in RoS 6.45.1

My observations after update from RoS 6.44.3 to RoS 6.45.1 are the following:

  • IKEv2 based tunnel works as expected, nothing changes
  • HAPac can up GRE tunnel to CRS326-24G-2S+ without any issues
  • CRS326-24G-2S+ can’t up GRE tunnel to HAPac
  • Adding of only ONE of the suggested in this topic rule “/ip firewall filter add chain=input action=accept protocol=gre ipsec-policy=in,ipsec” or “/ip firewall raw add chain=prerouting action=notrack protocol=gre” for both ends doesn’t help to bring up GRE tunnel from CRS326-24G-2S+ to HAPac
  • Adding of BOTH of the mentioned rules in ‘filter->input’ and ‘raw->prerouting’ respectively helps to bring up GRE tunnel from CRS326-24G-2S+ to HAPac

According to http://forum.mikrotik.com/t/radius-server-not-working-in-2-8-11/127/1 ‘filter->input’ rule is obvious “MUST to HAVE” for allowing new incoming GRE connections since RoS 6.45.1.
What about ‘raw->prerouting’ rule suggested in https://forum.mikrotik.com/viewtopic.php?f=21&t=149786&start=50#p737382 which also seems influences behavior of GRE in my setup?

Mikrotik guys and forum Gurus could you please provide neat answer on this matter?

Thank you!