Debug Basics

[kraal]

Awesome and thanks for the quick reply!

You’re welcome.

Yeah, that’s exactly what I was meaning. here’s what I’d do on the fortigate: debug packet flow
something like “diagnose debug flow filter addr 1.1.1.1” would let me see all IP packets with the 1.1.1.1 address in it. Then with extra flags I could see it match or not match all existing firewall rules in the tables as it flows through checking.

I wish I had such a tool on Mikrotik’s RouterOS (if it exists please someone tell us!)
You can try to play around with “/tool/sniffer” and “/tool/torch”, it can help you detect the packets, but you won’t be able to set the “extra flags” you’re used to.

I guess follow-up question then; if I think I’m hitting a bug on NAT masquerade where it doesn’t match based on the outbound interface (or int list), what would be the best way to prove or disprove that it’s not a configuration error somewhere else in my system? I’ve tried reducing the rules to basically just the Masquerade action and no other filter rules, but the only way I’ve gotten it to work is if there’s no other criteria except by using IP addresses or lists.

I would first gather as much information as possible, export my configuration, describe a simple use case, draw a minimal network diagram and would post it on this forum in a new thread. Then based on the outcome of the discussion (maybe it’s a bug, maybe it’s something you’re not used to as you’re new to RouterOS) I would then fix my configuration or open a support ticket on Mikrotik website to describe the bug and would point to the thread where the discussion was happening.

Cheers and good luck,