Hi guys,
I’m struggling with the following problem.
Mikrotik (HAP Lite) → WireTAP → DSL Modem
Firewall configuration:
# nov/06/2015 12:23:53 by RouterOS 6.32.3
# software id = I1XD-GX5R
#
/ip firewall filter
add chain=input comment="Accept established connections" connection-state=established
add chain=input comment="Accept related connections" connection-state=related
add action=drop chain=input comment="Drop invalid connections" connection-state=invalid
add chain=input comment=UDP protocol=udp
add chain=input comment="Allow limited pings" limit=50/5s,2 protocol=icmp
add action=drop chain=input comment="Drop excess pings" protocol=icmp
add chain=input comment="From our LAN" in-interface=bridge-local src-address=10.0.1.0/24
add action=log chain=input comment="Log everything else" log-prefix="DROP INPUT"
add action=drop chain=input comment="Drop everything else"
add chain=forward connection-state=established,related
add chain=forward dst-port=500 protocol=udp
/ip firewall nat
add chain=dstnat dst-address=213.135.XXX.XXX dst-port=500 protocol=udp src-address=10.0.1.201 src-port=500
add chain=dstnat dst-address=213.135.XXX.XXX dst-port=1701 protocol=udp src-address=10.0.1.201 src-port=1701
add chain=dstnat dst-address=213.135.XXX.XXX dst-port=4500 protocol=udp src-address=10.0.1.201 src-port=4500
add action=masquerade chain=srcnat comment="default configuration" out-interface=pppoe-out1 src-address=10.0.1.0/24 \
to-addresses=0.0.0.0
When I’m looking in the dumps from the TAP I see bogus packets, but in general the system works. All packets are well pppoe encapsulated. But sometimes the NAT is not done. With a very small packet rate 5 Packets/Minute.
10.0.1.198 → 80.67.29.6 TCP 62 53389→993 [RST] Seq=1 Win=0 Len=0
Why the are going around NAT? Is it a bug … a broken rule? I have no clue. Typically everything should be in the pppoe tunnel and the source should always be my public ip address.
regards
Mathias