I have two Mikrotik routers, R1 and R2, connected by a VPN.
On R1 I setup an/ip/socksserver, (SOCKS5) that works perfectly when I use it from Firefox on a LAN client behind R2.
When I use /ip/socksify instead of the Firefox proxy setting it works only with public websites. When I try to access a webserver in the LAN behind R1 (IP class 10.0.0.0/8) the browser says that the connection was reset.
I inspected the packages on R2 and I could see that in both cases the TCP (SYN) package is dst-natted as expected by the rule reported in the docs:
/ip/firewall/nat
add action=socksify chain=dstnat dst-port=80,443 protocol=tcp socksify-service=TOR_socksify src-address=<SOCKS_client_IP>
The new dst is the IP of R2 and the port of the socksify service (952), which looks ok to me. But then the package with 10.0.0.0/8 IP is not sent to the SOCKS server, while all the others are sent.
I'm not sure if I'm doing anything wrong of if it might be a bug, any experience on that?
EDIT: to confuse me even more, if I add another socksify nat rule for ICMP traffic I can ping the 10.0.0.0/8 host, while TCP/HTTP still does not work. If I disable the ICMP rule the ping stops working.