I have Windows Firewall set up in "block all" mode (i.e. everything is blocked by default). Only when I connect to my VPN is traffic then allowed through via a firewall rule (in this case, allowing UDP ports 500, 1701, 4500 via the specific VPN network adapter). This works fine.
However... recently my firewall changed from L2TP to IKEv2, and the above firewall setup stopped working. I was able to connect to the IKEv2 VPN but no traffic would flow through.
It turns out I had to create a rule for IP protocol #4 (IP-in-IP, encapsulation) in Windows Firewall and set that to "Allow" for all network adapters.
Allowing protocol #4 on all adapters feels insecure to me. So my question is:
Is there a way to allow IKEv2 traffic through the Windows Firewall without allowing protocol #4 across all adapters?