Does src-net also change source port if needed?

RouterOS General
1

Hello,
from wiki https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT#Source_NAT example:

/ip firewall nat
add chain=srcnat src-address=192.168.1.0/24 action=src-nat to-addresses=1.1.1.1 out-interface=Public
add chain=srcnat src-address=192.168.2.0/24 action=src-nat to-addresses=1.1.1.2 out-interface=Public

If both 192.168.1.5 and 192.168.1.6 clients starts (“simultaneously”) communication to identical service (e.g. DST IP/port 8.8.8.8:53) … AND both generate the same source port (like 43586 for example) … will

action=src-nat to-addresses=1.1.1.1

change one of the source ports?
If not - there will be a problem with returning right answer to right client.
I hope it will change source port of “little later” communication … but I haven’t found it nowhere explicitly written :frowning:

2

Yes it will. It has to, otherwise it wouldn’t work. It tries to keep original port if the mapping (newsrcaddr:srcport<->dstaddr:dstport) is free, but if not, it will change srcport.

3

Very cool, didnt know or think about that edge case…
Make sense because how would the router know where to send the return traffic, once it arrives back at the router???
Source IPs were changed to WANIP ( so those are the same )
Both destination port and destination IP are identical as indicated…
This leaves the source port as the only remaining identifying item for connection tracking to glom onto upon return…

4

Thanks - Ithought it but I had no proof. I tried to simulate that case (there I saw it keeps original port - as written), but it’s hard to force two clients to use same srcport :slight_smile:

5

It depends on client, it’s pretty easy with CHR I used. :slight_smile: