It appears that packets mangled with snpt / dnpt are excluded from connection tracking. Packets forwarded to LAN after dnpt have connection-state:invalid in the forward chain and therefore caught by the invalid → drop filter rule.
What would be the proper solution to this problem, address lists with a ttl?
Is it really expected for snpt / dnpt to break connection tracking? Could it that I’m hitting a bug or doing misconfiguration? Or it’s rather that RouterOS cannot mix stateful firewall with NPTv6?
NPTv6 is meant to be stateless aka no connection tracking. That’s the whole point of NPTv6, to avoid breaking layer 4 and avoid the requirements of NAT Traversal helpers.
Did you even read RFC6296? Do you not see the word “stateless”?
You should be firewalling on the hosts. Let the network, network.
There is no contradiction, just unfortunate implementation detail. Mikrotik could have put NPTv6 Translator functionality prior to the firewall. That would allow using connection tracking in the stateful firewall.
But the way it is currently integrated in the packet flow makes it annoying to use.
https://www.spinics.net/lists/netfilter/msg56371.html
I certainly don’t want NPTv6 traffic being conn_tracked, the whole purpose of NPTv6 is STATELESS. You can mail in IETF mailing lists to verify this.
Consider a setup where an NPT Translator is a physical device put between a site router and a service provider router. Its presence does not affect neither router, both deal with translated traffic and use stateful firewall with these translated packets because it’s completely independent.
So logically it is very much possible, it is just that RouterOS have it implemented this way (because they re-use netfilter?) where it is part of the only firewall.
I wonder if going the meta router path is a viable option here.