Remote loggin not using source address

RouterOS General
1

Hi,

I have encountered strange behavior. I am using ip address from lo interface as source address for remote log target ( 10.0.77.5 in this case ) :

name="remote" target=remote remote=172.16.9.6 remote-port=514 src-address=10.0.77.5 remote-log-format=syslog remote-protocol=udp syslog-time-format=bsd-syslog syslog-facility=daemon syslog-severity=auto

and its working as it should ( from sniffer on same host ):

24  1.147  vlan_routers  10.0.77.5:514 (syslog)  172.16.9.6:514 (syslog)  udp           122    0

but , when I change remote= to different IP address ( for example to 172.16.9.2 ) packets send to remote location have interface source address instead of IP address of lo.

24  21.905  vlan_routers  172.16.9.245:59333  172.16.9.2:514 (syslog)  udp           141    0

There are no NAT rules, routerOS version - 7.18.2

2

Do the packet dumps on the Tik, Firewall log rules, or even syslog debug messages. Can almost guarantee you that you will see the packets leaving the Tik with the source address specified.

3

Packet reaches remote location with 172.16.9.2 source address instead of 10.0.77.5

4

different routes to 172.16.9.2 and 172.16.9.6?

5

Yes

ADDRESS                          LOSS SENT    LAST     AVG    BEST   WORST STD-DEV STATUS                                                                                                                                                                                                            
172.16.9.241                       0%    1   0.1ms     0.1     0.1     0.1       0                                                                                                                                                                                                                   
172.16.9.6                         0%    1   0.1ms     0.1     0.1     0.1       0 

ADDRESS                          LOSS SENT    LAST     AVG    BEST   WORST STD-DEV STATUS                                                                                                                                                                                                            
172.16.9.244                       0%    1   0.2ms     0.2     0.2     0.2       0                                                                                                                                                                                                                   
172.16.9.2                         0%    1   0.1ms     0.1     0.1     0.1       0
6

Yeah - don’t check the destination - check the source. You claim the source is using the incorrect address, so check the source then.

7

I did. Read again please - I checked the SOURCE address of the packet at the remote location.

8

So check the source address, at the source -shrugs-

If the packet leaves the source, with the correct source address, then there is something natting it further down the line. If the source address is assigned on the device, and it is configured to use said source address, then the packet will leave the device with the correct source address

9

Packet leaves the router that generated it with incorrect source address. Packet reaches remote destination with incorrect source address. There is no NAT on any of these routers.

10

I'll try increasing the Vanga level to 70%.
Which bridge is the lo interface in?

11

lo interface is not present in any bridge. I am adding ip 10.0.77.5/32 directly to lo interface