Very good. ![]()
What still needs to be cleared (at least to me) is whether the netmap and the dst-nat actions can be exchanged at will or not (it seems that in cases like this one both work, so it is not clear if there is a reason to prefer the one over the other).
To be fair sindy did attempt to explain the difference:
the difference between netmap and (src|dst)-nat actions is that in case of netmap, the to-addresses parameter holds a prefix that is used to replace the prefix of the original address, leaving the suffix unchanged, whereas in case of (src|dst)-nat, to-addresses contains a list or range from which a whole address is “randomly” chosen to replace the original one. But same like (src|dst)-nat, the netmap action also replaces only one address, destination or source, depending on the chain where it is used (dstnat or srcnat).
but I still fail to appreciate the (possibly too subtle for my limited experience) difference in practice, i.e. when to use the one or the other.
@neoraptor
JFYI, the solution advised by sindy on the second thread:
http://forum.mikrotik.com/t/hex-lite-for-routing-between-subnets/180206/1
is actually more elegant as - by cleverly making use of interface list and address ranges - the number of firewall rules are reduced.