How to open access to only one IP within the Mikrotik network?

Question

Mikrotik

We have a communication channel with another office using ipsec, the problem is that this office walks throughout our network. It only needs access to a server with a static IP. How to forbid them to walk throughout our network and leave access to only one IP?

Answer 1

As an option, we cut everything that comes from ipsec, except for one address. or via ACL

ip firewall filter add in-interface=pptp-hq chain=forward action=reject dst-address=!IP