Redirecting [NAT] marked connections.

RouterOS Beginner Basics
1

Hi everyone.
Who can explain me, where is the mistake, I try to mark some connection via Laye-7:

/ip firewall layer7-protocol
add name=test_regexp="^.*(domaine\\.name\\.net).*\$"
/ip firewall mangle
add action=mark-connection chain=forward dst-port=80 layer7-protocol=test_regexp  new-connection-mark=conn_mark protocol=tcp

This part work fine, i saw that counter of packet in Matgle term grow up.
But in my next rule in NAT:

/ip firewall nat
add action=redirect chain=dstnat connection-mark=conn_mark protocol=tcp to-ports=8081

Nothing work… Counter stay at zero and nothing redirecting.

Pls, tell me what is wrong?
Thank you in advance, sorry for my English.

2

To redirect connection somewhere else using dstnat, you need to do it right from the very first packet. But the first packet is only SYN and it doesn’t contain much useful info, only addresses and ports. Anything you can match using L7 only comes later, but then it’s too late for dstnat.