1:1 NAT / DNAT configuration help

[lurker888]

Glad it’s working, and a great writeup! Now I will know where to refer people asking for this. It comes up several times a month.

The following part should be however corrected.

second one has connection and routing marks on traffic coming from the PLCs to the router.

/ip firewall mangle
# Mark connections based on the external IP being accessed
add chain=prerouting in-interface=ether1 dst-address=172.29.10.102 action=mark-connection new-connection-mark=plc1-conn comment="Mark PLC1 Connections"
add chain=prerouting in-interface=ether1 dst-address=172.29.10.103 action=mark-connection new-connection-mark=plc2-conn comment="Mark PLC2 Connections"
add chain=prerouting in-interface=ether1 dst-address=172.29.10.104 action=mark-connection new-connection-mark=plc3-conn comment="Mark PLC3 Connections"

# Convert connection marks to routing marks for policy routing - ONLY for packets coming from WAN
add chain=prerouting in-interface=ether1 connection-mark=plc1-conn action=mark-routing new-routing-mark=to-plc1 comment="Mark route to PLC1"
add chain=prerouting in-interface=ether1 connection-mark=plc2-conn action=mark-routing new-routing-mark=to-plc2 comment="Mark route to PLC2"
add chain=prerouting in-interface=ether1 connection-mark=plc3-conn action=mark-routing new-routing-mark=to-plc3 comment="Mark route to PLC3"

# Mark connections for return traffic from the PLCs to the WAN/Router
add chain=prerouting in-interface=ether1 connection-mark=no-mark action=mark-connection new-connection-mark=from-mgmt comment="Mark connection from MGMT side"
add chain=prerouting in-interface=ether2 connection-mark=no-mark action=mark-connection new-connection-mark=from-plc1 comment="Mark connection from PLC1"
add chain=prerouting in-interface=ether3 connection-mark=no-mark action=mark-connection new-connection-mark=from-plc2 comment="Mark connection from PLC2"
add chain=prerouting in-interface=ether4 connection-mark=no-mark action=mark-connection new-connection-mark=from-plc3 comment="Mark connection from PLC3"

add chain=output connection-mark=from-plc1 action=mark-routing new-routing-mark=to-plc1 comment="Mark route to PLC1"
add chain=output connection-mark=from-plc2 action=mark-routing new-routing-mark=to-plc2 comment="Mark route to PLC2"
add chain=output connection-mark=from-plc3 action=mark-routing new-routing-mark=to-plc3 comment="Mark route to PLC3"

A connection can have only one connection mark, and in these scenarios we use it to mark the initiator of the connection (hence the connection-mark=no-mark in the marking rules). The connections initiated on the WAN side get marked as from-mgmt. Marking the connections as to-plcX defeats this. It’s unnecessary and should not be done.

The rules

add chain=prerouting in-interface=ether1 dst-address=172.29.10.102 action=mark-connection new-connection-mark=plc1-conn comment="Mark PLC1 Connections"
add chain=prerouting in-interface=ether1 connection-mark=plc1-conn action=mark-routing new-routing-mark=to-plc1 comment="Mark route to PLC1"

should be condensed to one rule that directly applies the routing mark

add chain=prerouting in-interface=ether1 dst-address=172.29.10.102 action=mark-routing new-routing-mark=to-plc1 comment="Mark route to PLC1"

The solution as presented will still work in your use case, so it’s technically correct. The problem comes when you try to extend this to the case where the PLCs want to reach out to a host on the WAN side. (It’s not an uncommon next request that when PLC1 initiates a connection to 192.168.2.180, it should connect to 172.29.10.xxx, and the connection should be seen as coming from 172.29.10.102.)

If I drink too much coffee, I may even contribute to your article with a VRF-based approach to the same problem. I like it more, but it always gets brushed aside when I suggest it on this forum