Hello,
I have a Problem with Mikrotik and iPhone with NAT:
1-5 % of all Packets won’t be NATed correctly - some LAN packets will be forwarded to dmz without getting NATed:
shema:
internet
|
|
+--+---------------------+
| linux server |
| ext.ip.dmz.129 |
+--+---------------------+
|
|
+--+---------------------+
| ext.ip.dmz.143 eth0 |
| mikrotik dhcp-server |
| [color=#00FF00]192.168.101[/color].2 eth1 |
+--+---------------------+
|
|
+--+---------------------+
| switch-wlan |
+--+---------------------+
|
|
+--+---------------------+
| iphone [color=#00FF00]192.168.101[/color].149 |
+------------------------+
[guk@guktik2] > /interface ethernet export
dec/06/2009 19:37:42 by RouterOS 4.3
/interface ethernet
set 0 arp=enabled auto-negotiation=yes comment=2DACH-EXTERN disabled=no full-duplex=yes l2mtu=1600
mdix-enable=yes mtu=1492 name=2extern speed=100Mbps
set 1 arp=enabled auto-negotiation=yes comment=2wlan-ROUTER disabled=no full-duplex=yes l2mtu=1600
mtu=1492 name=2wlan speed=100Mbps
/ip address
add address=ext.ip.dmz.143/27 broadcast=ext.ip.dmz.159 comment=“DMZ” disabled=no interface=2extern
network=ext.ip.dmz.128
add address=192.168.101.2/24 broadcast=192.168.101.255 comment=“WLAN Netz” disabled=no interface=2wlan
network=192.168.101.0
/ip firewall nat
add action=masquerade chain=srcnat comment=Internet disabled=no out-interface=
2extern src-address=192.168.101.0/24
/ip route
add comment=“” disabled=no distance=1 dst-address=0.0.0.0/0 gateway=ext.ip.dmz.129 scope=255 target-scope=10
/ip firewall filter
add action=accept chain=forward comment=“Internet - zum dach gw” disabled=no dst-address=ext.ip.dmz.129
dst-port=53 in-interface=2wlan out-interface=2extern protocol=udp src-address=192.168.101.0/24
add action=accept chain=forward comment=“Internet rest ja” disabled=no in-interface=2wlan out-interface=
2extern src-address=192.168.101.0/24
add action=accept chain=forward comment=“Internet - Established” connection-state=established disabled=no
dst-address=192.168.101.0/24 in-interface=2extern out-interface=2wlan
add action=accept chain=forward comment=“Internet - Related NEW” connection-state=related disabled=no
dst-address=192.168.101.0/24 in-interface=2extern out-interface=2wlan
add action=accept chain=forward comment=“Internet PING” disabled=no in-interface=2extern out-interface=2wlan
protocol=icmp
linux-in-dmz# tcpdump -s0 -vni eth0 host 192.168.101.149
19:39:35.523117 IP (tos 0x0, ttl 63, id 27506, offset 0, flags [DF], proto: TCP (6), length: 40) 192.168.101.149.49829 > 194.232.116.174.80: R, cksum 0x8e98 (correct), 1:1(0) ack 1 win 32904
19:39:39.839287 IP (tos 0x0, ttl 63, id 44068, offset 0, flags [DF], proto: TCP (6), length: 40) 192.168.101.149.49819 > 194.232.116.174.80: R, cksum 0x5f1f (correct), 1:1(0) ack 1 win 32904
19:39:43.455372 IP (tos 0x0, ttl 63, id 37961, offset 0, flags [DF], proto: TCP (6), length: 52) 192.168.101.149.49913 > 75.125.36.226.80: F, cksum 0xc196 (correct), 0:0(0) ack 1 win 32904 <nop,nop,timestamp 840181647 1556393233>
any ideas why those packets wont be NATed and how to bring Mikrotik working as supposed?
thanx