Community discussions

MikroTik App
  4. RouterOS
  5. Beginner Basics

Forward chain ipsec rule placement

Post Reply
 
john4669
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 58
Joined: Mon Oct 23, 2017 8:35 pm

Forward chain ipsec rule placement

Thu Sep 17, 2020 5:30 am

This is an excerpt from a pretty common "basic" firewall script:
Code: Select all
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
I am trying to figure out why the ipsec policy needs to be before the established/related policy? What happens if it after it? Thanks.
Top
 
User avatar
karlisi
Member
Member
Posts: 440
Joined: Mon May 31, 2004 8:09 am
Location: Latvia

Re: Forward chain ipsec rule placement

Thu Sep 17, 2020 9:49 am

Ipsec rules should be before fasttrack rule, to exclude ipsec traffic from fasttrack. And fasttrack should be before accept established, related, untracked to work properly.
Top
 
User avatar
mkx
Forum Guru
Forum Guru
Posts: 11627
Joined: Thu Mar 03, 2016 10:23 pm

Re: Forward chain ipsec rule placement

Thu Sep 17, 2020 12:14 pm

And all of that because fasttrack causes packets to skip most of packet processing, which includes encapsulation/decapsulation of packets into/from IPsec tunnel ...
Top
Post Reply

Who is online

Users browsing this forum: Bing [Bot], dvdlss, Rox169 and 62 guests
  4. RouterOS
  5. Beginner Basics