I was using a modem (ADSL router) including the pppoe dialup connection. The mikrotik is connected to the ADSL router with a subnet in between. Port forwarding rules on both the ADSL router and the mikrotik to an internal HTTPS server with self-issued certificate was working perfectly.
I wanted to dialup the pppoe of the ADSL on the mikrotik. I converted the ADSL router into a bridge and created the pppoe connection on the mikrotik. I converted the dst-nat to accept from pppoe instead of ether2. I also removed other rules that was created for the previious scenario. The internet works perfectly, however dst-nat did not work. I also tried on port 21 for testing purposes but it didn’t work either.
Are you connected to two active ISP connections at the same time?
I see that ether1 is dhcp client, and pppoe-out1 is on ether2.
My guess (and I could be wrong) is that the dstnat works on your public IP address on ether1, but fail on the pppoe connection…
If this is your scenario, then the problem is that the dstnat is working on the inbound leg, but the replies from the internal server are being routed out via ether1 and not pppoe1.
What you need to do is enable some connection tracking and route-marking so that the replies are forced out whatever ISP they arrived on.
Yes, I am connected but we have three different internal networks. Two of the three are using one ISP connection and the third one is using the other ISP connection. Then, fail-over on the three networks is applied on both ISP connections. If both ISP connections fail, then only E and G network go to the third ISP connection (LTE).
Also, there are one https server in E and G network and there are two related dst-nat rules correspond to each https server.
Previously, both ether1 and ether2 were dhcp client. I wanted to convert them into pppoe one by one. However, converting the one on ether2 resulted in such problem. This means that both server became inaccessible although the rules are there. However, Internet access works fine.
You might be right regarding your suggestion. If this is true, then this means that the existing mark-routing rule does not work properly after the conversion to pppoe.
I tried hiding fragment=no but it doesn’t help.
I will now try to do it without any extra features on another mikrotik device using one ISP connection and one internal network (wiith pppoe and no mangle rules). I will feed you back.
Thanks
However complicated your routing policy might be, the first 3 rules need to be:
new connection in ISP1? Connection Mark ISP1 (regardless of which LAN it’s forwarding to)
new connection in ISP2? Connection Mark ISP2
new connection in ISP3? Connection Mark ISP3
This is because the inbound connection is tied to whichever public IP address the remote host is using to reach you, and ONLY that ISP’s network can reply with the proper IP address.