You are right if the traffic is not part of a VPN tunnel. But base on the documentation: When traffic passing through the MX matches a site-to-site VPN route, VPN firewall rules are applied in descending order. VPN traffic is only subject to the site-to-site firewall rules and is never subject to Layer 3 firewall rules. Then, I do not think this is the way to go, but I'm may be in error since I never do that in a MX before.
... View more
