Nat masqurade problem with existing nat (src-nat & dst-nat)

[CGGXANNX]

@kalel

the goal is , the traffic got into 10.10.4.xx first ( because it’s ether 1 ) , but the actuall happen is the traffic goes into ether 2 ( 11.11.1.x) first and the SRC Nat not working, example if i look at log screenshot the 11.11.1.22 it does not changing into 10.10.4.22 ( because i set the nat ) but it becomes some other ip that did not set in configuration

If you look at the MikroTik firewall flowchart, then you'll see the reason for what you observed:

• When incoming connections arrive on ether1, with dst-address in the 10.10.4.x range, the first NAT action that will be performed on the initial packet are DSTNAT rules, box #10 in the flowchart.

• Which means, if the destination addresses matches, then DSTNAT will change all the dst-address of those incoming packets into the range 11.11.1.x.

• The initial packet of the connections will be put in the forward chain, with out-interface=ether3 (appropriate out-interface for the destination 11.11.1.0/27).

• Packets go through the other part of the firewall, including the filter forward rules (box #14).

• Only near the end they will be handled by the SRCNAT rules at #25. But at this moment, the dst-address of the packets are 11.11.1.x, which obviously are not the 10.10.4.x values you use in the conditions of the SRCNAT rules, so none of them match.

• As a result, the source of the packets are not modified.

You'll need to modify all those SRCNAT rules, and put in the dst-address condition the destination address after being modified by DSTNAT (the addresses in the 11.11.1.x range, plus a condition connection-nat-state=dstnat to be sure the connections have previously been modified by the DSTNAT rules.