On a IOS 1812 router I have a GRE tunnel (over IPSec) set up and it is working. The router connects to the internet through a PPPoE connection using Dialer0. The configuration of the tunnel is as follows:
interface Tunnel1
ip address 10.10.10.1 255.255.255.252
no ip route-cache cef
no ip route-cache
ip tcp adjust-mss 1420
no ip mroute-cache
keepalive 10 3
tunnel source Dialer0
tunnel destination 1.2.3.4
end
Now I want to set up a firewall to only accept incoming SMTP traffic and otherwise use the CBAC firewall to inspect all outgoing traffic.
So basically I add these two lines to the tunnel interface: (10.1.0.2 is the LAN IP address of the local SMTP server)
access-list 101 permit tcp any host 10.1.0.2 eq smtp log
access-list 101 deny ip any any log
ip inspect name tunnelfw tcp
ip inspect name tunnelfw udp
ip inspect name tunnelfw icmp
internet Tunnel 1
ip access-group 101 in
ip inspect tunnelfw out
end
This, however, does nothing at all. All traffic passes in both directions without problem through the tunnel. It is possible to connect from the remote side to any port on any IP address on the local LAN.
There is nothing logged, either, although the access-list has log statements.
If I add another access list for testing purposes to the out direction, I get all outgoing traffic properly logged:
access-list 102 permit ip any any log
interface Tunnel1
ip access-group 102 out
end
So it seems as if the GRE tunnel interface only allows outbound filtering but not inbound filtering. Is that true?
Even if I try this filtering:
access-list 101 deny ip any any log
internet Tunnel 1
ip access-group 101 in
end
All traffic passes in although the access list should filter all.
So how do I filter the traffic which is arriving from the remote side through my GRE tunnel?
