VRF Firewall Rule - in/out-interface matcher not possible

RouterOS General
1

I am currently using VRFs and i want to use Firewall Filter Rules for that.

I wanted to use the physical interface, which is going to my ISP. Then i get the following error message:

 1  I ;;; in/out-interface matcher not possible when interface (sfp-sfpplus1) belongs to vrf - use 'PUBLIC-VRF' interface instead
      ;;; No Forward Spoofed Address
      chain=forward action=drop src-address-list=PRIVATE-INT-SUBNET in-interface=sfp-sfpplus1 log=no log-prefix=""

It is strange, because when i am using an interface list, where only that pysical interface is in that list, it is working.

 0    ;;; No Forward Spoofed Address
      chain=forward action=drop src-address-list=PRIVATE-INT-SUBNET in-interface-list=ISP-EXT log=no log-prefix=""

Is that a bug in RouterOS or how should i handle those spoofing rules in RouterOS?

Regards

2

No, it's not a bug, it's also documented in the manual. See this thread for more:

3

The error is basically telling you how RouterOS sees it: once sfp-sfpplus1 is inside the VRF, forwarded traffic is matched on the VRF interface and not anymore on the physical port.

So in-interface=PUBLIC-VRF is the intended way to do it, and it should work fine as long as your ISP uplink is the only interface in that VRF.

The fact that the interface-list version is accepted doesn’t necessarily mean that it really matches the traffic. I would watch the packet counter on this rule while testing. If it stays at 0, then it is silently not matching anything, which is actually worse than getting the error.

4

As already mentioned in the linked thread, in-interface-list and out-interface-list both work normally as expected.

5

Thanks, I didn't know the lists kept working after 7.14. Good to know, that's
the simpler way then.