The issue I ran into (even back on ROSv6) was that the 66.2.148.252/29 route from R1 would be sent to R2, designating the 10.200.0.1 as the next hop for that route. The same would happen the other way also. Once these routes distributed, the tunnel would drop because now the R1 and R2 were not sending tunnel management traffic directly between 66.2.148.252 and 203.30.61.30, but instead between 10.200.0.1 and 10.200.0.2. This would cause the tunnel to be in a continuous cycle of going down and coming back up until OSPF redistributed the route. I solved this in ROSv6 by creating an OSPF out-filter on both routers that would not distribute the external IP's route to the other routers.
Now in ROSv7, I'm trying to do the same thing. However, I can't seem to get the out-filter to prevent the route to distribute. Here's my config. I'll readily admit that I don't understand many of the options of OSPF in ROSv7, so there's a good chance I'm doing something else wrong.
R1
Code: Select all
/ip address
add address=66.2.148.252/29 interface=ether1 network=66.2.148.248
add address=10.200.0.1/30 interface=wireguard-site2site network=10.200.0.0
---SNIP---
/routing filter rule
add chain=ospf-out disabled=no rule="if ( dst in 66.2.148.252/29 ) { reject; }"
/routing ospf instance
add disabled=no name=ospf-v2-instance out-filter-chain=ospf-out router-id=\
OSPF_ID
/routing ospf area
add area-id=0.0.0.1 disabled=no instance=ospf-v2-instance name=site-to-site
/routing ospf interface-template
add area=site-to-site disabled=no networks=10.200.0.0/30,0.0.0.0/0 type=ptpCode: Select all
/ip address
add address=203.30.61.30/29 interface=ether1 network=203.30.61.24
add address=10.200.0.2/30 interface=wireguard-site2site network=10.200.0.0
---SNIP---
/routing filter rule
add chain=ospf-out disabled=no rule="if ( dst in 203.30.61.30/29 ) { reject; }"
/routing ospf instance
add disabled=no name=ospf-v2-instance out-filter-chain=ospf-out router-id=\
OSPF_ID
/routing ospf area
add area-id=0.0.0.1 disabled=no instance=ospf-v2-instance name=site-to-site
/routing ospf interface-template
add area=site-to-site disabled=no networks=10.200.0.0/30,0.0.0.0/0 type=ptpWhen OSPF connects up, it's as if my out rules don't exist and it happily distributes those routes. Could someone tell me what I'm doing wrong?