When access need to be given to clients from more VRFs, we just need to add more MACVLAN interfaces. As an example, with ether2 being member of a VRF tertiary with the IP address 192.168.88.1/24 assigned:
/ip vrf
add interfaces=ether2 name=tertiary
/ip address
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
We add the MACVLAN interface and address:
/interface macvlan
add interface=vrf-link name=vrf-link-tertiary
/ip vrf
set [find name=tertiary] interfaces=ether2,vrf-link-tertiary
/ip address
add address=172.18.0.22/24 interface=vrf-link-tertiary network=172.18.0.0
To keep the NAT and mangle rules minimal, we use interface lists and address lists.
/interface list
add name=VRFs
/interface list member
add interface=ether2 list=VRFs
add interface=ether3 list=VRFs
/ip firewall address-list
add address=172.20.80.2 list=VRF-LOCAL
add address=192.168.88.1 list=VRF-LOCAL
add address=172.20.80.0/24 list=VRF-RANGES
add address=192.168.88.0/24 list=VRF-RANGES
We give the previous routing table to-secondary-vrf a more common name to-vrfs and add the routes to this table:
/routing table
add fib name=to-vrfs
/ip route
add dst-address=172.20.80.0/24 gateway=172.18.0.21@main routing-table=to-vrfs
add dst-address=192.168.88.0/24 gateway=172.18.0.22@main routing-table=to-vrfs
Our DSTNAT rules are modified to use interface lists and address lists:
/ip firewall nat
add action=dst-nat chain=dstnat dst-address-list=VRF-LOCAL dst-port=53 \
in-interface-list=VRFs protocol=udp to-addresses=172.18.0.20
add action=dst-nat chain=dstnat dst-address-list=VRF-LOCAL dst-port=53 \
in-interface-list=VRFs protocol=tcp to-addresses=172.18.0.20
add action=dst-nat chain=dstnat dst-address-list=VRF-LOCAL dst-port=8291 \
in-interface-list=VRFs protocol=tcp to-addresses=172.18.0.20
add action=dst-nat chain=dstnat dst-address-list=VRF-LOCAL dst-port=80 \
in-interface-list=VRFs protocol=tcp to-addresses=172.18.0.20
Same for the mangle rules:
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark \
connection-state=new in-interface=vrf-link-main src-address-list=VRF-RANGES \
new-connection-mark=from-vrfs
add action=mark-routing chain=output connection-mark=from-vrfs \
new-routing-mark=to-vrfs