Firewall Filter Rule, dst-address problem [Resolved]

RouterOS General
1

Hi All,

I just upgraded to 6.0rc14 and am experiencing a new problem. If I apply a dst-address to the filter rule I cannot get port forwarding to work. This was functional prior to upgrade.

;;; WAN → LAN; FTP ← THIS WORKS
chain=forward action=accept connection-state=new protocol=tcp
in-interface=ether1-gateway-pppoe dst-port=21

;;; WAN → LAN; FTP ← THIS DOESN’T WORK
chain=forward action=accept connection-state=new protocol=tcp dst-address=90.57.188.162 in-interface=ether1-gateway-pppoe dst-port=21

;;; NAT WAN → LAN; FTP ← NAT STATEMENT REMAINS CONSTANT
chain=dstnat action=dst-nat to-addresses=10.0.0.100 to-ports=21 protocol=tcp dst-address=90.57.188.162 in-interface=ether1-gateway-pppoe dst-port=21

What am I missing here or should I just reach out to support for this? Seems pretty straight forward to me but hoping I’m not missing something. P.S. public IP’s have been altered.

2

The issue here was that I was using the destined public IP address. Since it processes the NAT rule first the dst-address should have been the private ip listed in the NAT.