Main Question:
Is the connection tracking in routerOS separated when using VRFs?
Problem:
I have multiple Devices with the same ip address (192.168.2.10) that are communicating with the same dst-IP (192.168.2.1). All those devices are connected to an individual ether-Interface on the router.
Bidirectional communication must be possible.
-
I need a way to communicate from a host (10.12.0.253) with each device (current working solution addressing different IPs on Uplink ehter-Interface as MACVLAN interfaces). Traffic needs to be dst- and src-natted, in order for the devices to respond (can only communicate with 192.168.2.1).
-
Furthermore each device has to be able to communicate with my host, initiating the connection. 192.168.2.10 → 192.168.2.1 → dst-nat to 10.12.0.253 and for response to the corresponding ip be src-natted to the out interface.
Current solution works for both cases for ICMP pings. (Config below, Using VRFs)
Simultaneous connections from host to devices is possible. (from 10.12.0.253 to 10.12.0.1 and from 10.12.0.253 to 10.12.0.2; both connections are correctly tracked)
BUT Simultaneous connections initiated from the devices fail.
Behaviour:
Connection tracking in firewall shows me, that only one connection is tracked as device A starts pinging 192.168.2.1. (src address 192.168.2.10 dst-address 192.168.2.1 connection mark vrf1)
Starting a second ping form device B to 192.168.2.1, no extra connection is tracked (src would be 192.168.2.10 and dst-address 192.168.2.1; same as before but should be connection marked vrf2)
Hence the Ping responses from my host end up being routed to device A.
Is there an error in the VRF config as i am using it.
Previous trys:
same behaviour was present without using VRFs and instead using routing tables, connection marking and dst- and src-nat the requests in a similar fashion.
I tried to replicate http://forum.mikrotik.com/t/vrf-lite-with-mangle-and-dstnat-to-reach-multiple-vlans-with-overlapping-ips/174948/1 and referenced post http://forum.mikrotik.com/t/managing-two-separate-subnet-with-same-class-addresses/130530/1 without luck.
Setup:
routerOS 7.18.2
interface macvlan add interface=ether5 mac-address=02:7E:53:97:48:E2 mode=private name=macvlan1
/interface macvlan add interface=ether5 mac-address=D6:BE:D8:21:2B:D4 mode=private name=macvlan2
/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik
/ip vrf add interfaces=ether2,macvlan2 name=vrf2
/ip vrf add interfaces=ether1,macvlan1 name=vrf1
/interface ovpn-server server add mac-address=FE:2C:9C:70:71:05 name=ovpn-server1
/ip address add address=10.12.0.2/24 interface=macvlan2 network=10.12.0.0
/ip address add address=192.168.2.1/24 interface=ether1 network=192.168.2.0
/ip address add address=192.168.2.1/24 interface=ether2 network=192.168.2.0
/ip address add address=10.12.0.1/24 interface=macvlan1 network=10.12.0.0
/ip dhcp-client
# Interface not active
add interface=ether4
/ip firewall address-list add address=10.12.12.100 list=real_smgw
/ip firewall address-list add address=10.12.12.101 list=cls-init
/ip firewall address-list add address=10.12.12.102 list=cls-init
/ip firewall address-list add address=10.12.12.103 list=cls-init
/ip firewall mangle add action=mark-connection chain=prerouting in-interface=macvlan1 new-connection-mark=vrf1
/ip firewall mangle add action=mark-connection chain=prerouting in-interface=macvlan2 new-connection-mark=vrf2
/ip firewall mangle add action=mark-connection chain=prerouting in-interface=ether1 log=yes new-connection-mark=vrf1
/ip firewall mangle add action=mark-connection chain=prerouting in-interface=ether2 log=yes new-connection-mark=vrf2
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=vrf1 new-routing-mark=vrf1 passthrough=no
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=vrf2 new-routing-mark=vrf2 passthrough=no
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=vrf2 disabled=yes new-routing-mark=vrf2
/ip firewall mangle add action=mark-routing chain=prerouting connection-mark=vrf1 disabled=yes new-routing-mark=vrf1 passthrough=no
/ip firewall nat add action=dst-nat chain=dstnat connection-mark=vrf1 in-interface=macvlan1 to-addresses=192.168.2.10
/ip firewall nat add action=dst-nat chain=dstnat connection-mark=vrf2 in-interface=macvlan2 to-addresses=192.168.2.10
/ip firewall nat add action=masquerade chain=srcnat connection-mark=vrf1 out-interface=ether1
/ip firewall nat add action=masquerade chain=srcnat connection-mark=vrf2 out-interface=ether2
/ip firewall nat add action=dst-nat chain=dstnat connection-mark=vrf1 in-interface=ether1 log=yes log-prefix="dst-nat vr1" to-addresses=10.12.0.253
/ip firewall nat add action=dst-nat chain=dstnat connection-mark=vrf2 in-interface=ether2 to-addresses=10.12.0.253
/ip firewall nat add action=masquerade chain=srcnat connection-mark=vrf1 log=yes log-prefix="src-nat vr1 out" out-interface=macvlan1 to-addresses=10.12.0.1
/ip firewall nat add action=masquerade chain=srcnat connection-mark=vrf2 out-interface=macvlan2 to-addresses=10.12.0.2
/ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=macvlan1@vrf1 routing-table=vrf1 scope=30 suppress-hw-offload=no target-scope=10 vrf-interface=vrf1
/ip route add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=macvlan2@vrf2 routing-table=vrf2 scope=30 suppress-hw-offload=no target-scope=10 vrf-interface=vrf2
Any insight would be helpful.