I have a use case where i need a layer 2 NAT, to hide the mac address of a device. Layer 3 NAT is not possible in this use case because there is no L3 NAT helper for the protocol that needs to be nated.

I was not able to do it inside the same router (RB5009 - Ros 7.14rc2).

I tried to use the bridge filter, for the L2 NAT, and for the ARP fixer. But a couple things did not work, specially the arp-reply actions.

Then finally i did try to use an external RB3011 router with Ros 6.49.13. It was not working. Then i did use an old RB450G with Ros 6.38.5.

Here it did work. This 6.38.5 Ros version was before the VLAN aware bridge code. Seems like the new VLAN aware bridge code is not fully working for layer 2 filtering, even inside 6.49.13.

But i would like to get that working inside the RB5009 with Ros 7.14. What would be the solution ?

I thought that it should be possible to use a container ? But which one ?

Would be nice if it was possible to have some kind of Metarouter package where we could choose an older RouterOS version with fully working bridge filter. Containers are nice, but Metarouter were a lot simpler for Ros virtual instances.