Why is Mikrotik OpenVPN client not connecting to the server?

Question

openvpn

OVPN server - Ubuntu 16.04, client - Mikrotik (ROS 6.42.6). Firewall is configured like this:

 /ip firewall filter> print 
Flags: X - disabled, I - invalid, D - dynamic 
 0    ;;; Allow IGMP
      chain=input action=accept protocol=igmp in-interface=ether1wan log=no log-prefix="" 

 1    ;;; IPTV UDP incoming
      chain=input action=accept protocol=udp in-interface=ether1wan dst-port=1234 log=no log-prefix="" 

 2    ;;; IPTV UDP forwarding
      chain=forward action=accept protocol=udp dst-port=1234 log=no log-prefix="" 

 3    ;;; Allow ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 4    ;;; default drop
      chain=input action=drop in-interface=ether1wan log=no log-prefix=""

The OVPN connection is configured and instantly connects when the 4th default-drop rule is disabled. On the previous configuration of Mikrotik, everything also worked, but there I set it up without further ado through Quick Set, now I'm slowly setting it up on a clean configuration. It looks like the Firewall is dropping packets from the OVPN server and not allowing the connection to be established. Therefore, it is necessary to prescribe a rule before the drop that will allow the server to interact with the client. The question is - what rule should be added?

Answer 1

Solution: you need to allow established connections (rule 4).

0    ;;; Allow IGMP
      chain=input action=accept protocol=igmp in-interface=ether1wan log=no log-prefix="" 

 1    ;;; IPTV UDP incoming
      chain=input action=accept protocol=udp in-interface=ether1wan dst-port=1234 log=no log-prefix="" 

 2    ;;; IPTV UDP forwarding
      chain=forward action=accept protocol=udp dst-port=1234 log=no log-prefix="" 

 3    ;;; Allow ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 4    ;;; Allow established connections
      chain=input action=accept connection-state=established log=no log-prefix="" 

 5    ;;; default drop
      chain=input action=drop in-interface=ether1wan log=no log-prefix="dropall"