I need to route all the smtp traffic out a specific WAN (ethernet) port. I only only get smtp traffic in that same port but connection tracking fails to get it routed back the way it came in. Likewise smtp traffic that originates inside also needs to go out that same port. Yet it fails to do so even when route marking is used.
I have two WAN ports, #1 is static (centurylink) and #2 is dynamic (comcast). Traffic arriving on #1 is routeable and has destinations within my local network. Traffic arriving on #2 is basically garbage as all traffic on this port is srcnatted and all incoming traffic is port scanners.
/interface ethernet
set [ find default-name=ether2 ] comment="ether2, static" name=centurylink
set [ find default-name=ether1 ] comment="ether1, dhcp" name=comcast
/ip dhcp-client
add comment=dhcp dhcp-options=hostname,clientid disabled=no interface=comcast
/ip firewall mangle
add action=jump chain=prerouting comment="jump to mark_conn" connection-mark=no-mark jump-target=mark_conn
add action=mark-routing chain=mark_conn comment="smtp out mark rte to cent" dst-port=25 in-interface=inside
log=yes new-routing-mark=rte_cent passthrough=yes protocol=tcp
add action=return chain=mark_conn comment=return
add action=log chain=postrouting comment="log smtp" protocol=tcp src-port=25
add action=log chain=postrouting comment="log smtp" dst-port=25 protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat comment=masq log-prefix=nat out-interface=comcast
/ip route
add comment="route to centurylink" distance=2 gateway=192.168.1.253 routing-mark=rte_cent
/ip route rule
add comment="route rule to centurylink" dst-address=192.168.1.253/32 interface=centurylink routing-mark=rte_cent table=main
Some traffic gets routed correctly and some does not -
14:21:33 firewall,info mark_conn: in:inside out:(unknown 0), src-mac 00:24:8c:f8:79:6f, proto TCP (ACK), 198.202.168.4:51448->17.178.97.79:25, len 1500
14:21:33 firewall,info postrouting: in:(unknown 0) out:centurylink, src-mac 00:24:8c:f8:79:6f, proto TCP (ACK), 198.202.168.4:51448->17.178.97.79:25, len 1500
14:21:33 firewall,info mark_conn: in:inside out:(unknown 0), src-mac 00:24:8c:f8:79:6f, proto TCP (ACK,PSH), 198.202.168.4:43694->104.47.34.33:25, len 73
14:21:33 firewall,info postrouting: in:(unknown 0) out:centurylink, src-mac 00:24:8c:f8:79:6f, proto TCP (ACK,PSH), 198.202.168.4:43694->104.47.34.33:25, len 73
14:21:33 firewall,info postrouting: in:(unknown 0) out:inside, src-mac 00:0f:cc:2f:93:28, proto TCP (ACK), 17.178.97.79:25->198.202.168.4:51448, len 52
14:21:34 firewall,info postrouting: in:(unknown 0) out:inside, src-mac 00:0f:cc:2f:93:28, proto TCP (SYN), 45.32.199.242:48950->198.202.168.4:25, len 60
14:21:34 firewall,info postrouting: in:(unknown 0) out:comcast, src-mac 00:24:8c:f8:79:6f, proto TCP (SYN,ACK), 198.202.168.4:25->45.32.199.242:48950, len 60
14:21:34 firewall,info mark_conn: in:inside out:(unknown 0), src-mac 00:24:8c:f8:79:6f, proto TCP (ACK,PSH), 198.202.168.4:53684->104.47.36.33:25, len 376
14:21:34 firewall,info postrouting: in:(unknown 0) out:centurylink, src-mac 00:24:8c:f8:79:6f, proto TCP (ACK,PSH), 198.202.168.4:53684->104.47.36.33:25, len 376
14:21:34 firewall,info postrouting: in:(unknown 0) out:inside, src-mac 00:0f:cc:2f:93:28, proto TCP (ACK), 104.47.36.33:25->198.202.168.4:53684, len 52
14:21:34 firewall,info postrouting: in:(unknown 0) out:comcast, src-mac 00:24:8c:f8:79:6f, proto TCP (SYN,ACK), 198.202.168.4:25->45.32.199.242:48950, len 60
14:21:35 firewall,info mark_conn: in:inside out:(unknown 0), src-mac 00:24:8c:f8:79:6f, proto TCP (SYN), 198.202.168.4:54594->74.125.69.26:25, len 60
14:21:35 firewall,info postrouting: in:(unknown 0) out:centurylink, src-mac 00:24:8c:f8:79:6f, proto TCP (SYN), 198.202.168.4:54594->74.125.69.26:25, len 60
ALL this port 25 (smtp) traffic should go out centurylink.
- What am I doing wrong????
- The postrouting traces with "in:(unknown 0)" concern me. The mangle table should know where every packet comes from, right???
Thanks,
Phil