Hello,
I have a tunneled connection between AWS and a customer endpoint.
I got a Mikrotik that receives by one tunnel the traffic from AWS, NATs and through another tunnel sends the traffic to the customer.
Both are IPsec tunnels.
Communication from the AWS network works (icmp and telnet to certain port) but there is no echo to some tcp packets they are sending to that very same port, and they are blaming the network.
I am 90% sure the network is just fine, since I can see the hits in my NAT rules on both directions, and also the telnet connected to that port should be enough proof that the network is OK. I have even prepared a mangled rule just to record the return traffic and it is being hit each time they try their script: (10.15.1.1 is the customer and the 10.93.0.0 is the AWS network)
09:13:16 firewall,info TO_AWS forward: in:pppoe-out1 out:pppoe-out1, src-mac xx:xx:xx:xx:xx:xx, proto TCP (SYN,ACK), 10.15.1.1:9998->10.93.1.100:33722, NAT (10.15.
1.1:9998->10.1.200.2:9998)->(10.2.200.15:33722->10.93.1.100:33722), len 60
But I dont manage to sniff the return traffic to the AWS. It seems I only get the way-in traffic, and never the return. It is driving me nuts. I filter with the AWS address, and I expect to see the traffic going from and going back. But I never capture the traffic going back!! Even while I am pinging and I’m getting echo replies, wireshark only shows me one direction packet with the message “no response found”
I prepare the sniffer in the Winbox, choosing the outside interface, putting the AWS IP network, direction: any, operation:and.
(I choose direction any even when I think the direction is always TX in my case (both tunnel enter and exit through the outside interface and traffic is never initiated by us). I have anyway tried to apply filter for the RX and nothing is recorded)
My NAT rules goes:
Fron AWS 10.93.0.0/22 to 10.1.200.2 (which is my Mikrotik)
I dstNAT this traffic to the destination 10.15.1.1
0 chain=dstnat action=dst-nat to-addresses=10.15.1.1 src-address=10.93.0.0/22 dst-address=10.1.200.2 log=yes log-prefix=""
then I do the scrnat
1 chain=srcnat action=src-nat to-addresses=10.2.200.8/29 src-address=10.93.0.0/22 dst-address=10.15.1.1 log=yes log-prefix=""
So if someone can shade some light here: how could I capture traffic in that very last step of the communication, I mean, the return traffic to the AWS?
Thank you very much!