The problem is - it would and it does. I didn’t make this up from thin air. It’s issue that occurs in my config. Packets forwarded by top router are not processed by forward chain in firewall at all. I added unconditional drop and packets still got forwarded. If dstnat occurs between 2 different ports then firewall works. However if they are looped back through the same interface forward chain in firewall is not processed. That’s why I created this thread. Because it looks like anomaly to me. If it was dropped it’d be correct behavior and I wouldn’t bring up this topic
True - firewall on my second router detected and dropped packets because I had there rules dropping such traffic (and I’m logging drops in firewall so I saw that packets got forwarded)
I use extremely fine grained whitelist firewall so I was quite confused that packets get forwarded even though they shouldn’t be matched by any rule. But when I added drop all as first rule and it still looped packets back I realized something’s wrong. Especially considering that packets coming from WAN were properly blocked, only ones looped on the same interface sneaked through firewall.
Tomorrow I’ll try to recreate issue with CHRs lab so I’ll be able to check whether it’s related to my particular config or it’s general behavior. However I already faced few “anomalies” in MikroTik NAT processing (eg. this: http://forum.mikrotik.com/t/loopback-nat-is-performed-only-once/121914/1) so I wouldn’t be surprised