What's wrong with this NAT command ?

RouterOS Beginner Basics
1

Probably a dumb question but why does this fail

[me@mikrotik.contoso.com] /ip firewall nat> add action=accept chain=srcnat comment="Something" dst-address=<172.16.175.0/24> src-address=<172.16.100.0/24>
value of range must have ip address before '/'

Thanks

2

Because characters < and > shouldn’t be there. It’s just dst-address=172.16.175.0/24.

3

Without knowing the use case and seeing the rest of the config, hard to say.

4

Right you are - interestingly they would not matter if you enter a single IP, such as in

/ip ipsec peer
add address=<1.2.3.4> exchange-mode=ike2 local-address=<5.6.7.8> \
    name="Somethng" profile="Somewhere"

Still… not quite there though

[at@mikrotik.router.contoso.com] /interface> print
Flags: D - dynamic, X - disabled, R - running, S - slave 
 #     NAME                                TYPE       ACTUAL-MTU L2MTU  MAX-L2MTU
 0  R  Host A                              ether            1500  9014
 1  R  Host C                              ether            1500  9014
 2  R  interrouter                         ether            1500  9014
 3  R  wan                                 ether            1500  9014
 4 DR  <l2tp-remoteuser>                   l2tp-in          1450
 5 DR  <pptp-iplom-usg>                    pptp-in          1450
 6 DR  <sstp-aaaaaa>                       sstp-in          1500
 7 DR  <sstp-bbbbbbb>                      sstp-in          1500
 8 DR  <sstp-ccccc>                        sstp-in          1500
 9 DR  <sstp-ffffCCR>                      sstp-in          1500
10 DR  <sstp-mailgate>                     sstp-in          1500
11  X  eoip-hostonly                       eoip             1458 65535
12  X  eoip-mgmt                           eoip             1458 65535
13  X  hostonly_bridge                     bridge    
14  X  mgmt_bridge                         bridge    
15  X  sstp-ffff-drp                       sstp-out  

[at@mikrotik.router.contoso.com] > ip firewall filter
[at@mikrotik.router.contoso.com] /ip firewall filter>> add action=accept chain=inpu
t dst-address=172.16.100.254 in-interface-list=wan ipsec-policy=in,ipsec src-addre
ss=172.16.175.0/24   
input does not match any value of interface-list
[at@mikrotik.router.contoso.com] /ip firewall filter>>

Isn’t wan a valid interface ?

5

Use in-interface or out-interface to use interface name.

You have to define the interface list if you want to use in-interface-list or out-interface-list.

/interface list
add name=WAN

/interface list member
add list=WAN interface=wan
6

Thanks - that was it !