Thank you for for comment, here the result on the router:Do you have an input rule from your LAN to the Mikrotik? Looking at your rule base, that doesn't seem to be the case.
Can you post the outputs of the following commands?Code:/ip firewall/filter/print where chain=input/ip firewall/filter/print where chain=forward/ip firewall/filter/print where chain=output
Code:
/ip firewall/filter/print where chain=inputFlags: X - disabled, I - invalid; D - dynamic 0 ;;; Acept IPSec packets chain=input action=accept protocol=ipsec-esp log=no log-prefix="" 1 ;;; Acept L2TP packet chain=input action=accept protocol=udp dst-port=1701,500,4500 log=no log-prefix="" 2 ;;; Accept IKE2 UPD ports 500,4500 IPSec chain=input action=accept protocol=udp dst-port=500,4500 log=no log-prefix="" 3 ;;; Accept traffic IKE2 VPN to LAN chain=input action=accept src-address=10.10.11.0/24 log=no log-prefix="" ipsec-policy=in,ipsec 4 X chain=input action=drop src-mac-address=E8:CA:C8:FC:50:6D log=no log-prefix="" 5 ;;; Drop invalid IPSec Address chain=input action=drop src-address-list=Invalid_IPSec log=no log-prefix="" Code:
/ip firewall/filter/print where chain=forwardFlags: X - disabled, I - invalid; D - dynamic 6 ;;; Accept traffic L2TP VPN to LAN chain=forward action=accept src-address=10.10.10.0/24 dst-address=192.168.0.0/24 log=no log-prefix="" 7 chain=forward action=accept src-address=10.10.11.0/24 dst-address=192.168.0.0/24 log=no log-prefix="" 8 ;;; Accept traffic PPTP VPN to LAN chain=forward action=accept src-address=10.10.12.0/24 dst-address=192.168.0.0/24 log=no log-prefix="" 9 ;;; Accept traffic to ERP chain=forward action=accept protocol=tcp dst-address=192.168.0.11 dst-port=211 log=no log-prefix="" 10 chain=forward action=accept protocol=tcp dst-address=192.168.0.11 dst-port=212 log=no log-prefix="" 11 chain=forward action=accept protocol=tcp dst-address=192.168.0.11 dst-port=213 log=no log-prefix="" 12 chain=forward action=accept protocol=udp dst-address=192.168.0.11 dst-port=213 log=no log-prefix="" 13 chain=forward action=accept protocol=udp dst-address=192.168.0.11 dst-port=212 log=no log-prefix="" 14 chain=forward action=accept protocol=udp dst-address=192.168.0.11 dst-port=211 log=no log-prefix="" 15 X ;;; Drop invalid addresses E8:CA:C8:FC:50:6D chain=forward action=drop src-mac-address=E8:CA:C8:FC:50:6D log=no log-prefix="" 16 ;;; Drop invalid traffic. chain=forward action=drop connection-state=invalid log=no log-prefix="" Code:
/ip firewall/filter/print where chain=outputFlags: X - disabled, I - invalid; D - dynamic Statistics: Posted by ductiena12 — Wed Jan 03, 2024 8:54 am