Community discussions

MikroTik App
 
wkstill
just joined
Topic Author
Posts: 15
Joined: Wed Mar 25, 2009 8:43 pm

Can't block non-ipsec traffic?

Fri Apr 03, 2009 6:15 pm

I setup a IPSEC tunnel between the Public IP of two Router Boards
I then setup an un-encyrpted L2TP between the two Router Boards.

If I torch to Public ethernet port , I see "IPSEC" Traffic. (no L2TP udp/1701 Traffic)

If I setup a filter rule to drop all traffic EXCEPT for the IPSEC traffic, it blocks the L2TP on Said Port.

I then changed it to a "LogOnly" Filter, and it logs EVERY bit of traffic over the IPSEC Tunnel...

The Public IP's are on Bridges, the Public Ethernet Ports are members of Said Bridge, Filters @ Ethernet has no effect, Filtering @ Bridge, Blocks everything., its as if the "IPSEC" sits before the Filter in ip-firewall
 
wkstill
just joined
Topic Author
Posts: 15
Joined: Wed Mar 25, 2009 8:43 pm

Re: Can't block non-ipsec traffic?

Fri Apr 10, 2009 12:14 am

nobody?
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7198
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: Can't block non-ipsec traffic?

Mon Apr 20, 2009 10:35 am

Look at packet flow diagram, probably it will explain why everything is dropped in firewall.
http://wiki.mikrotik.com/wiki/Packet_Fl ... encryption
 
wkstill
just joined
Topic Author
Posts: 15
Joined: Wed Mar 25, 2009 8:43 pm

Re: Can't block non-ipsec traffic?

Wed Apr 22, 2009 6:08 pm

Thanks, To bad IPSEC traffic couldn't be seperated in the chain. or add a "ipsec" flag to the pre-filter rule or something... wishfull thinking, probably gonna have to stack two rb's on each end.