directed broadcast and nat

RouterOS General
1

I have a very specific issue, i want to make my dumb aircon to be discoverable outside its broadcast domain.
Basically the APP that does the discovery performs a directed broadcast (they could obviously just use a plain broadcast) inside its subnet and discovers the air con.
After a simple discovery, a regular unicast communication is established between the APP and the aircon.

I wanted to perform dstnat on the ingress packet and direct it to the subnet where the aircon resides (using directed broadcast “helper” address is fine…).

What I’m experiencing is that the dstnat rule actually matches the ingress directed broadcast packet (packet count and log confirms this) but nothing is happening with the packet as if its silently dropped.
Is this the ROS expected behaviour for directed broadcast or I’m missing something?
To note, even with Mikrotik “security policy decision” to block driected broadcast, users SHOULD be able to enable it for specific scenarios!!

current situation:
APP discovery: 10.2.0.20:30000@UDP → 10.2.0.255:30050
desired situation:
APP discovery: 10.2.0.20:30000@UDP → 10.2.0.255:30050 → dstnat → 10.2.0.20:30000@UDP → 10.2.2.0/24_l2_bcast:30050

/ip firewall nat
add action=dst-nat chain=dstnat comment=\
    "forward daikin aircon probes to IOT network" dst-address=10.2.0.255 \
    dst-port=30050 in-interface=sfp1.1200 log=yes protocol=udp src-port=30000 \
    to-addresses=10.2.2.244
/ip arp
add address=10.2.2.244 comment="directed broadcast helper address" interface=\
    sfp1.1202 mac-address=FF:FF:FF:FF:FF:FF
/ip address
add address=10.2.0.1/24 interface=sfp1.1200 network=10.2.0.0
add address=10.2.2.1/24 interface=sfp1.1202 network=10.2.2.0
2

Destination doesn’t seem to be important. I tried a quick test and I can’t dstnat broadcast packet even to unicast address. Without dstnat, I see it first in prerouting and then in input. When I add dstnat rule, I see packet in prerouting, then dstnat rule gets a hit and I no longer see it in input (that’s expected), so dstnat is able to “steal” it. But it isn’t in forward either and there isn’t any third way to go. I tried to find some info how iptables in Linux deals with it, but all I’m finding is “how do I do it?” and “help, it doesn’t work!” stuff.

3

Can someone from MT comment on this?

4

bump

5

ancient bump…

6

really ancien bump :wink:

have you been able to solve your problem ? I’m facing kind of the same situation :slight_smile:

Thanks !