IPSEC & Access Rules

[LarsVanCasteren]

Hi, 

I have two RV325's connected using Gateway to Gateway using static WAN's on both sides. I would like to enable an access rule to only allow only the static wan ip's access to IPSec on each of the RV's. When creating deny rules I noticed it never truly denies, even when explicitly setting the remove WAN ip. 

When creating a G2G tunnel does the RV overwrite the access rules somehow?

Thanks!

1. RV32X> access-list show
2. access-list 1
3.     interface: wan1
4.     Enable
5.     Deny
6.     service: IPSEC_2 udp 4500
7.     src ip: <remote_wan_ip>
8.     dst ip: <local_wan_ip>
9.     no log
10.     time range always
11. access-list 2
12.     interface: wan1
13.     Enable
14.     Deny
15.     service: IPSec udp 500
16.     src ip: <remote_wan_ip>
17.     dst ip: <local_wan_ip>
18.     log packets matching this rule
19.     time range always
20. access-list 3
21.     interface: wan1
22.     Enable
23.     Allow
24.     service: HTTPS tcp 443
25.     src ip: any
26.     dst ip: any
27.     no log
28.     time range always
29. access-list 4
30.     interface: lan
31.     Enable
32.     Allow
33.     service: All Traffic all 1~65535
34.     src ip: 192.168.0.1/255.255.255.0
35.     dst ip: any
36.     no log
37.     time range always
39. access-list 5
40.     interface: lan
41.     Enable
42.     Allow
43.     service: All Traffic all 1~65535
44.     src ip: 192.168.15.1/255.255.255.0
45.     dst ip: any
46.     no log
47.     time range always
49. access-list 6
50.     interface: lan
51.     Enable
52.     Allow
53.     service: All Traffic all 1~65535
54.     src ip: 192.168.1.1/255.255.255.0
55.     dst ip: any
56.     no log
57.     time range always
59. access-list 7
60.     interface: usb1
61.     Enable
62.     Deny
63.     service: All Traffic all 1~65535
64.     src ip: any
65.     dst ip: any
66.     no log
67.     time range always
69. access-list 8
70.     interface: usb2
71.     Enable
72.     Deny
73.     service: All Traffic all 1~65535
74.     src ip: any
75.     dst ip: any
76.     no log
77.     time range always
79. access-list 9
80.     interface: wan1
81.     Enable
82.     Deny
83.     service: All Traffic all 1~65535
84.     src ip: any
85.     dst ip: any
86.     no log
87.     time range always
89. access-list 10
90.     interface: dmz
91.     Enable
92.     Deny
93.     service: All Traffic all 1~65535
94.     src ip: any
95.     dst ip: any
96.     no log
97.     time range always