NAT broadcast to unicast?

RouterOS General
1

Would it be possible to catch a UDP broadcast packet with an NAT rule and redirect it to a host that’s not in the same L2 segment of the network?

I have an IOT device that tends to send stuff to the broadcast address (UDP I think) and I want to interact with it from a Virtual Machine that’s sitting at a remote site (I don’t have any local servers here other than a PI)

Both sites are linked via an L2TP/IPSEC tunnels between 2 RB450’s

I guess if NAT can’t be used for this I Suppose I could extend the Vlan to encompass both sites but that will be rather messy in terms of traffic egress to the internet I would think.

2

IOT tends to use unicast and link-local addressing which won’t be forwarded by routers.
There is a Cisco feature called ip helper address which does what you’re looking to do, but I’m not aware of an equivalent feature in Mikrotik.

The VLAN bridging is probably your best idea, and you can make it manageable.

I assume you have a Mikrotik at the remote site…

Create an EoIP tunnel between the sites (and protect it with IPSec).
On the local site, add the EoIP tunnel interface to the LAN bridge.
On the remote site, don’t bridge the EoIP tunnel, but put a static IP address on it directly.
If the IOT’s network is 192.168.1.0/24, then you may use 192.168.1.254/24 on the remote EoIP interface (assuming the address doesn’t conflict with any devices at the main site)

Make sure the remote site’s LAN is not using the same IP range as the main site’s LAN. Let’s say the remote LAN is 192.168.2.0/24 - you will create a static route in the primary site’s router:
/ip route add dst=192.168.2.0/24 gateway=192.168.1.254

Make sure that your NAT configurations do not do any src/dst NAT on packets between 192.168.1.0/24 and 192.168.2.0/24, and that the filter rules allow packets across the tunnel.

Finally, you should configure IGMP proxy on the remote site with the EoIP interface as “upstream” and the LAN interface as “downstream”

/routing igmp-proxy interface
add interface=EoIP upstream=yes
add interface=LAN

That should get you rolling and in a way that won’t cause the remote site’s Internet to tunnel through the main site’s network on its way out to the world.

3

If I was going to bridge across sites it would only be my IOT vlan anyway so wouldn’t be all the remote sites traffic :wink:

Also no need for static routes, I have OSPF working between the 2 sites :wink:

4

Well, then, it sounds like you’ve got it going on then!
(I would personally use OSPF too, but I don’t like to recommend more advanced things unless I know the experience level of the person asking for help)

I think multicast forwarding (IGMP proxy) is going to be the thing that helps you the most. Lots of that stuff uses UPnP with mcast group 239.255.255.252 - if your routers pass that stuff along, then you should be able to have multi-site availability, provided the devices themselves are able to work with remote networks. (I’ve seen “remote network denied” messages, from UPnP devices, for instance)

5

It’s not UPNP, but the device tends to reply to queries directed at by sending the reply to the broadcast address on port 9671 I believe (It’s a lightwaveRF link, it pulls electricity usage and controls a few remote switched sockets)

I’m also probably getting an IR blaster if it ever turns up, who knows what protocol that thing talks :laughing:
Think the IR blaster also has a 433mhz radio transmitter, will be interesting to see if I can get it to switch the other RF controlled plug adaptors I have from an older system. (which i’ve lost the remote for :laughing: )