The ultimate Mikrotik iptables flowchart

To be honest, I got a bit embarrassed at my error with regard to the “src addr” thing, so before writing my reply, I injected packets into

  • a Mikrotik (running 7.191.)
  • an Ubuntu machine modified to run iptables
  • an Ubuntu, as stock, running in iptables-nftables compatibility (as has been the default for many years now)
  • in all instances the route the packet took was according to the ingress interface.

Then I went and looked at the source code: lo and behold, you can guess what I found.

So it’s clear that “from self” is the correct one.

The “dst addr=own addr” thing is a bit simplified but largely accurate. (I still think “to self” would be better, but the “dst addr” one is at least accurate enough.)

EDIT: Yes, I hate being wrong.