Another application case - two VPN clients on the same router that need to connect to the same remote server via different WANs of the router. For some VPN types (L2TP), you can specify source-address and use policy routing to link each to another WAN; for other ones (SSTP), the source-address parameter is not available. So now, you can configure each with a different remote port to connect to (as you need to keep the address the same so that verification of server address/fqdn by certificate would not fail), use the dst-port to choose the WAN, and then use the dst-nat rule in output to redirect the outgoing packet to the actual port.
Oh no, Google is trying to hack into my router!
19:50:47 system,error,critical login failure for user root from 8.8.8.8 via ssh
Or maybe…
input: in:internal out:(unknown 0), src-mac a0:d3:5e:f3:f0:26, proto TCP (SYN), 192.168.80.10:60573->192.168.80.184:22, len 52
input: in:internal out:(unknown 0), src-mac a0:d3:5e:f3:f0:26, proto TCP (ACK), 192.168.80.10:60573->192.168.80.184:22, NAT (192.168.80.10:60573->8.8.8.8:60573)->192.168.80.184:22, len 40
That’s weird. What could it be? Aaah, I know, it’s output’s friend input:
/ip firewall nat
add chain=input protocol=tcp dst-port=22 action=src-nat to-addresses=8.8.8.8
@sindy: I don’t want to risk overheating my brain, but wouldn’t this also help with your L2TP/IPSec loop?
If “help with” is an euphemism for “allow to get rid of”, then yes - the sole purpose of the hairpin tunnel was to work around the unavailability of src-nat on input in ROS 6. But unless the contemporary connection tracking can also be set to prefer maximum diversity, in terms that it would try to assign a distinct IP part of reply-dst-address to each connection, the script taking care about incrementing the to-addresses address in the src-nat rule will have to stay.
You could also have the clients use a different DNS than the router. Then, you can use static DNS of the router to provide the internal address webserver to itself. Output in in NAT is not needed then.
The Address-list is also fed that way, and that could be a problem.