VPN client inside the network should see only 1 ip address, how?

Question

VPN

Good afternoon!
There is such a solution, through windows 2008 a VPN client gets into the network, it is always assigned a static address 192.168.1.170, it is necessary that he sees only 1 resource 192.168.1.195 inside the network. The network is built on Mikrotik. How can this be implemented?
Thank you!

Answer 1

If stupidly on the forehead - then like this:
With this rule, you will deny the client access to everything except the address of this resource. If the client is Windows, then it will also not be able to go to the Internet at this moment, because it prescribes vpn as the default gateway for itself. Then you can also add out-interface = to the rule! ether1-wan , this should help. Do not forget to change the interface name to the actual one for your router.

Answer 2

ip firewall filter
add chain=forward src-address="192.168.1.170" dst-address="192.168.1.195" action=accept
add chain=forward src-address="192.168.1.170" action=drop