Masquerade, dst-nat and policy based routing

RouterOS General
1

So i’ve got a customer who’s got some servers hosted behind a NAT and ports forwarded to it. He’s also got two WAN links. We’ll call them WAN1 and WAN2. I need to do some policy-based routing over WAN1 which just so happens to be the WAN link that the dst-nat rules are on.

Here’s what I set up:

  1. Routing mark on for default route on WAN1
  2. Route to private IPs within WAN1’s routing table
  3. mangle prerouting rule to mark outbound port 25 traffic with WAN1 mark
  4. mangle prerouting rule to mark all inbound traffic with WAN1 mark

No matter how I try, I cannot get the servers to remain accessible from the outside. What is the typical mangle strategy for making this work?

2

Does this help?

/ ip firewall mangle
add chain=input in-interface=wlan1 action=mark-connection new-connection-mark=wlan1_conn
add chain=input in-interface=wlan2 action=mark-connection new-connection-mark=wlan2_conn
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla1
add chain=output connection-mark=wlan1_conn action=mark-routing new-routing-mark=to_wla2

/ ip route
add dst-address=0.0.0.0/0 gateway=10.XXX.XXX.XXX routing-mark=to_wla1
add dst-address=0.0.0.0/0 gateway=10.XXX.XXX.XXX routing-mark=to_wla2