Sacking of packets from LAN to INET through NAT

Dear all,
I set up two port on RB450.

First one is Internet port with 77.236.194.90/25 which is port to Internet.
Second one is LAN port with 10.12.0.1/24 which is local network (LAN).
Default gw is set to 77.236.194.1 which is gw of my ISP.
There’s also set masquarade: /ip firewall nat chain=srcnat action=masquerade src-address=10.12.0.0/24 out-interface=Internet

Everything is working properly: Clients from 10.12.0.0/24 can access Internet connection, but there’s one non-understandable problem:
There’re packet sacking from 10.12.0.0/24 to Internet port. I can catch them on torch:

/tool torch Internet dst-address=10.12.0.0/24 port=0 
SRC-PORT  DST-ADDRESS     DST-PORT  TX         RX         TX-PACKETS RX-PACKETS
                                                                               
SRC-PORT  DST-ADDRESS     DST-PORT  TX         RX         TX-PACKETS RX-PACKETS
                                                                               
SRC-PORT  DST-ADDRESS     DST-PORT  TX         RX         TX-PACKETS RX-PACKETS
80 (http) 10.12.0.100     4675      320bps     0bps       1          0         
80 (http) 10.12.0.42      57564     320bps     0bps       1          0         
80 (http) 10.12.0.42      57563     320bps     0bps       1          0         
80 (http) 10.12.0.42      57567     320bps     0bps       1          0         
                                                                               
SRC-PORT  DST-ADDRESS     DST-PORT  TX         RX         TX-PACKETS RX-PACKETS
80 (http) 10.12.0.42      57565     320bps     0bps       1          0         
80 (http) 10.12.0.100     1114      0bps       0bps       0          0         
                                                                               
SRC-PORT  DST-ADDRESS     DST-PORT  TX         RX         TX-PACKETS RX-PACKETS
80 (http) 10.12.0.100     1114      320bps     0bps       1          0         
80 (http) 10.12.0.61      1804      320bps     0bps       1          0         
80 (http) 10.12.0.100     4982      0bps       0bps       0          0

I can also catch these packets on gw 77.236.194.1.

There’re only few packets in comparison with whole traffic and all of them have src-port 80.
Do you have idea, why i have these packets here?

RouterOS 3.10 (RB450)

Thank for help.
Andy

it works, thank you :slight_smile: Andy

MikroTik Support [Janis Megis] napsal(a):

Hello,

Add drop rule for connection-state=invalid packets in the filter chain
forward.

Regards,
Janis Megis

Ondřej Šibřina <ondra@mojestopa.cz> wrote:

Dear Mikrotik,
Can you help me with this problem?
http://forum.mikrotik.com/t/sacking-of-packets-from-lan-to-inet-through-nat/27057/1

Thank you.

Ondrej Sibřina