Preserve Port number on src Nat rule

RouterOS Beginner Basics
1

Hi all

I have 3 x pabx that i need to interconnect. Once the Mikrotik see the first connection request leave it creates and entry with port 5060 ther after other connections port numbers are changed to random ports. The issue is that a 3rd party manages some of the mikrotik that a reponse is required from, and they have a port allow list (access port allow) so the random ports are unknow and the dst nat rule does not work thus the pabx never receives its 200 ok reponse the trunk does not register.

eg pabx request packet (src ip) 192.168.7.100 (src port) 5060 gets masquraded to Public ip and random port (src ip) 222.222.123.1 (src port) 33967 when the response comes in from the other end port 33967 this port being a random port is not on the allowed port list and is dropped

what is the best way to write a src nat rule to so that the Router will preserve the src port
eg (src ip) 192.168.7.100 (src Port) 5060 => natted (src ip) 222.222.123.2 ( src port 5060 )

Thanks in advance

2

Use action=src-nat in the srcnat rule so that you can specify to which port should the IP address be sourcenatted:

/ip firewall nat
add action=src-nat chain=srcnat protocol=tcp src-port=5060 src-address=192.168.7.100 to-addresses=222.222.123.2 to-ports=5060

Just make sure to put the rule before any masquerade one because the rules are processed sequentially

3

Of course the root problem is that you cannot have multiple sessions running from the same IP and same port number.
The NAT will keep the port number unchanged “as possible”. So normally you see the port 5060 being used.
But now that you have 3 PABXes, the port will have to be something else for 2 of them.

You will at least need to use some other port for the 2 extra PABX, e.g. 5062, 5064.
But when you do that, it is best to do it in the PABX, not in the router. You can probably configure the port number there.
And when you really need to do it in the router, you will have to write your rules with a to-ports=5062 for example.

4

Thank you for the reply , the 3 pabx are at different locations so it is only 1 pabx on each location but we interconnecting them via sip peer trunk we can see the Sip options being sent but we do nto get back the 200 Ok beacsue of the nat rewrite on the port.