VPN inbound Filters

[josfonse]

Hi all, 

Is there a way to filter incoming VPN traffic on the MX?

Thank you.

[BrickBR]

Via SD-WAN with other branches/spokes and Hubs, Client VPN or Third Party VPN? 

If via SD-WAN, Security & SD-WAN -> Site-to-site VPN -> Site-to-site outbound firewall.

By configuring a "inbound" policy destined to your desired branch or branches, you effectively have an "incoming" filter, even with it being blocked on outbound at the other sites. This is due to the fact that the policy is applied to all firewalls in the org

[PhilipDAth]

You can only configure outbound VPN filter rules.  To control what can come inbound, you have to restrict what is outbound from other sites.

[josfonse]

In the case of a tunnel to a non-Meraki peer, is there a option available to filter inbound vpn traffic?

[KarstenI]

No, this is IMO the biggest restriction of the MX.