Firewall Quirkyness.

RouterOS General
1

I am trying to get the router to report a specific IP for its responses to ICMP ttl expires.

I mark the packets with mangle in the OUTPUT queue, type icmp message 11 which I can see are matching correctly. I then SRC-NAT all the packets with that packet mark. The SRC-NAT rules never find a match.

Any ideas why this happens? In linux I just directly do a SRC nat on the OUTPUT queue but mikrotik only allows SRC-NAT in POSTROUTING it seems, hence the mangle, mark, nat methodology.

2

I’ve tried this as well and never gotten it to work… I was trying to get ICMP rejects to go out a with a specific ip but couldn’t.

Sam