Understanding NAT

RouterOS Beginner Basics
1

Hello all

Please help me to understand the packet flow scenario in case of NAT.

local host 192.168.0.10/24
router LAN is 192.168.0.1/24
router WAN 100.100.100.100/30
router has the NAT rule “chain=srcnat in-interface-list=LAN src-action=src-nat to-addresses=100.100.100.100 out-interface=WAN”

host attempting to access remote host 200.200.200.200
As i see it by packet flow diagram (https://wiki.mikrotik.com/wiki/Manual:Packet_Flow_v6)

  1. First packet from host going to I point, then in prerouting chain this new connection obtain some internall connection ID at conntrack facility. Packet src address = 192.168.0.10 and dst-address = 200.200.200.200;
  2. Dst-nat facility of prerouting changes src-address to 100.100.100.100 and put connection ID to some internal nat table (to determine that it’s need snat on back way). Packet becomes src-address=100.100.100.100 and dst-address=200.200.200.200;
  3. Packet comes to routing decision and passing to FORWARD chain, because it has no src or dst-addresses of this router. After that postrouting and leaves the router;
  4. Reply packet comes to router from WAN. src-address is 200.200.200.200 and dst-address is 100.100.100.100. In the same way it goes to I point, prerouting;
  5. Conntrack facility found that it is the same connection as first packet, put in to the same connection ID;
  6. Dst-nat facility found this conntrack ID and now this packet should be src-nated.

Is it happens at dst-nat facility, then packet goes to OUTPUT chain, or somehow (how) it goes to FORWARD chain and get’s SNAT in src-nat chain of postrouting? Or some other order?

2

Seems like your overcomplicating it…
First of all, if its a dynamic wanip I would use masquerade vice src-nat for action.
If using src-nat action then why not put in
/add chain=src-nat src-address=192.168.0.1/24 to-addresses=100.100.100.100 action=src-nat

In terms of packet flow, when a packet leaves the LAN and gets to the router, the router will change the local IP of the device to the WANIP.
Upon return of associated packets the Router will strip off the WANIP and replace it with the correct local LANIP.

Destination NAT DST-NAT is a completely different beast at least for me and is designed to ensure unsolicited incoming traffic is correctly directed to the intended target.
In your question the traffic returning is a known entity.