Mikrotik 2011UAS,
5th LAN is enabled on the LAN,
9th LAN connected provider (transtelecom2), the interface is assigned static address X.X.X.X (X.X.X.y - gateway).
In the future, will be connected to several providers.
Problem: we need to translate the port 4890 to gain access from the outside through each provider on the local computer
10.8.0.200. Thus, we need to make sure that the answer was going through the same provider, and from which the request came.
I mark the traffic that came from the first provider, and the route to be used when answering:
[admin@MikroTik] /ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; mark conn transtelecom2-in
chain=prerouting action=mark-connection new-connection-mark=transtelecom2-in passthrough=no connection-state=new in-interface=ether9
1 chain=prerouting action=mark-routing new-routing-mark=transtelecom2-out passthrough=no connection-mark=transtelecom2-in
4890 Port forwarding:
[admin@MikroTik] /ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; transtelecom2
chain=srcnat action=masquerade src-address-list=local dst-address-list=!local out-interface=ether9
...
...
6 ;;; RDP200
chain=dstnat action=dst-nat to-addresses=10.8.0.200 to-ports=4890 protocol=tcp dst-address=х.х.х.х dst-port=4890
Created routes: default- no markings (number 3) and labeled - to answer it passed through the same provider from which the request came (at number 2):
[admin@MikroTik] /ip route> print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S ;;; mark transtelecom2-icmp
0.0.0.0/0 х.х.х.y 1
1 X S ;;; route for users_megaline
0.0.0.0/0 Megaline_100035 1
2 A S ;;; mark transtelecom2-out
0.0.0.0/0 х.х.х.y 1
3 A S ;;; route non routing-mark
0.0.0.0/0 х.х.х.y 25
4 ADC 10.8.0.0/24 10.8.0.5 ether5 0
5 ADC 10.8.4.0/30 10.8.4.1 ether10 0
6 ADC X.X.X.Z/30 X.X.X.X ether9 0
Filters:
[admin@MikroTik] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
...
4 ;;; Drop Invalid connections
chain=input action=drop connection-state=invalid
5 ;;; Drop block-list connections
chain=forward action=drop connection-state=new src-address-list=block
...
10 ;;; Allow established connections
chain=input action=accept connection-state=established
11 ;;; Allow related connections
chain=input action=accept connection-state=related
12 ;;; full access for Local
chain=input action=accept src-address-list=local
13 ;;; full access for Local
chain=forward action=accept src-address-list=local
14 ;;; All other inputs drop
chain=input action=drop
-- [Q quit|D dump|up|down]
If the last rule of Mangle (number 1) disabled, the external access to the port is working, the client successfully connects externally. But in this case, the traffic is not routing-mark, and go the default-route. As soon as I activate this rule, external access is lost.
For several days, I can not find a solution, please help for any advice I would be grateful ..