Should dst-nat go through input chain of ip firewall?

RouterOS General
1

I have an IPSEC VPN device sitting behind the mikrotik 3.19.

I have on nat: dstnat forwarding ports to the VPN server.

I have on input ip firewall: accept rules for those ports.

The IPSEC VPN server works fine through the Mikrotik… no problems.

However, WinBox shows 0 packets on all of the input accept rules, and only a few packets on the NAT dstnnat rules.

Shouldn’t both of those show packets constantly increasing? This VPN tunnel is used 24/7 but I just don’t see the traffic in the Miktotik.

I DO see traffic on the interface, just not through the NAT or FIREWALL.

Again, everything is working fine… I just can’t figure out why I don’t see the traffic.

2

The ‘input’ chain is for packets destined for the router itself. http://wiki.mikrotik.com/wiki/Firewall_filter#Chains
Since the packets are flowing through the router and not terminated on the router itself, the ‘input’ rules do not count packets. You should be seeing packet counts increase in the ‘forward’ chain.

The NAT rule counts up when a new flow is established, afterward state is kept and the translation is performed for each packet in the flow. Since VPN tunnels use the same flow for all encapsulated packets, you’d see the rule count increase by one when a tunnel is established but not while the tunnel is up.

3

Ok, great! So, dst-nat will never go through the input chain if it is destined for another computer on the network, correct?

4

From the link:

  • input - used to process packets entering the router through one of the interfaces with the destination IP address which is one of the router’s addresses. Packets passing through the router are not processed against the rules of the input chain
  • forward - used to process packets passing through the router
  • output - used to process packets originated from the router and leaving it through one of the interfaces. Packets passing through the router are not processed against the rules of the output chain

Packets between networks the router connects will not be in the ‘input’ chain, they will be in the ‘forward’ chain.

5

Another quick question regarding IPSEC behind the router: As I said, it works fine, but it takes longer than normal for the tunnel to start working. Connected directly to the Internet connection, the VPN server starts working after a couple seconds. Going through the router, it takes about 10 seconds to start working.

Not a big deal, but I would like to find out why this happens…

6

Protocol 50 is being dst-nat, and it is actually being used as indicated by torch, but it always shows 0 packets in NAT. Shouldn’t it at least increment at the initial connection like udp 500 does?