RB1100AHx2, RouterOS 6.44.1.
Web-server in LAN IP: 192.168.111.111 MAC: 11:11:11:11:11:11
Gateway in WAN IP: zzz.zzz.zzz.zzz MAC: ZZ:ZZ:ZZ:ZZ:ZZ:ZZ
Remote client in far away IP: yyy.yyy.yyy.yyy
/ip arp print
DC zzz.zzz.zzz.zzz ZZ:ZZ:ZZ:ZZ:ZZ:ZZ wan
HDC 192.168.111.111 11:11:11:11:11:11 lan
/ip firewall nat print
chain=dstnat action=dst-nat to-addresses=192.168.111.111 to-ports=80 protocol=tcp dst-address=xxx.xxx.xxx.xxx dst-port=80 log=yes log-prefix=“nat_111”
/ip firewall filter print
chain=forward action=log dst-address=xxx.xxx.xxx.xxx log=no log-prefix=“”
chain=input action=drop dst-address=xxx.xxx.xxx.xxx log=yes log-prefix=“drop_111”
Firewall log filtered by the remote IP:Port yyy.yyy.yyy.yyy:42784
Apr 13 12:48:09 gateway firewall,info nat_111 dstnat: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (SYN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 52
Apr 13 12:48:09 gateway firewall,info forward: in:wan out:lan, src-mac zz.zz.zz.zz.zz.zz, proto TCP (SYN), yyy.yyy.yyy.yyy:42784->192.168.111.111:80, NAT yyy.yyy.yyy.yyy:42784->(xxx.xxx.xxx.xxx:80->192.168.111.111:80), len 52
Apr 13 12:48:09 gateway firewall,info forward: in:lan out:wan, src-mac 11.11.11.11.11.11, proto TCP (SYN,ACK), 192.168.111.111:80->yyy.yyy.yyy.yyy:42784, NAT (192.168.111.111:80->xxx.xxx.xxx.xxx:80)->yyy.yyy.yyy.yyy:42784, len 52
Apr 13 12:48:09 gateway firewall,info forward: in:wan out:lan, src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK), yyy.yyy.yyy.yyy:42784->192.168.111.111:80, NAT yyy.yyy.yyy.yyy:42784->(xxx.xxx.xxx.xxx:80->192.168.111.111:80), len 40
Apr 13 12:48:09 gateway firewall,info forward: in:lan out:wan, src-mac 11.11.11.11.11.11, proto TCP (ACK,PSH), 192.168.111.111:80->yyy.yyy.yyy.yyy:42784, NAT (192.168.111.111:80->xxx.xxx.xxx.xxx:80)->yyy.yyy.yyy.yyy:42784, len 1500
Skipped 126 wan->lan packets and 230 lan->wan packets. All of them are in forward and are using NAT.
Apr 13 12:48:20 gateway firewall,info forward: in:lan out:wan, src-mac 11.11.11.11.11.11, proto TCP (ACK,PSH), 192.168.111.111:80->yyy.yyy.yyy.yyy:42784, NAT (192.168.111.111:80->xxx.xxx.xxx.xxx:80)->yyy.yyy.yyy.yyy:42784, len 633
Apr 13 12:48:20 gateway firewall,info forward: in:wan out:lan, src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK), yyy.yyy.yyy.yyy:42784->192.168.111.111:80, NAT yyy.yyy.yyy.yyy:42784->(xxx.xxx.xxx.xxx:80->192.168.111.111:80), len 52
Apr 13 12:48:24 gateway firewall,info forward: in:lan out:wan, src-mac 11.11.11.11.11.11, proto TCP (ACK,FIN), 192.168.111.111:80->yyy.yyy.yyy.yyy:42784, NAT (192.168.111.111:80->xxx.xxx.xxx.xxx:80)->yyy.yyy.yyy.yyy:42784, len 40
Apr 13 12:48:24 gateway firewall,info forward: in:wan out:lan, src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK), yyy.yyy.yyy.yyy:42784->192.168.111.111:80, NAT yyy.yyy.yyy.yyy:42784->(xxx.xxx.xxx.xxx:80->192.168.111.111:80), len 40
Apr 13 12:49:09 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 41
Apr 13 12:49:14 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,FIN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
Apr 13 12:49:14 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,FIN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
Apr 13 12:49:15 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,FIN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
Apr 13 12:49:16 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,FIN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
Apr 13 12:49:18 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,FIN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
Apr 13 12:49:23 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,FIN), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
Apr 13 12:49:33 gateway firewall,info drop_111 input: in:wan out:(unknown 0), src-mac zz.zz.zz.zz.zz.zz, proto TCP (ACK,RST), yyy.yyy.yyy.yyy:42784->xxx.xxx.xxx.xxx:80, len 40
What the reason for the last 8 packets after the prerouting’s dstnat appear in the input chain instead of the forward?
What should I do to provide all the packets addressed to the xxx.xxx.xxx.xxx:80 are sending to the forward chain?