I have a RouterOS (v6.49.10) device that is connecting an outside endpoint via IPSEC that talks to one device on the local side of the router, they have to talk to it via an IP that it does not have for their application. ie local device is 10.1.1.2 but they (192.168.2.2) will call it 10.99.1.2. I setup NETMAP rules for srcnat and dstnat chains :
/ip firewall nat
add action=netmap chain=srcnat dst-address=192.168.2.2 src-address=10.1.1.2 to-addresses=10.99.1.2
add action=netmap chain=dstnat dst-address=10.99.1.233 src-address=192.168.2.2 to-addresses=10.1.1.2
/ip ipsec policy
add dst-address=192.168.2.2/32 peer=ike1-s proposal=ike1-s src-address=10.99.1.2/32 tunnel=yes
ICMP traffic works and is translated. The endpoint 2.2.2.2 can ping through the IPSEC tunnel (different IPs). I can see the traffic gets translated and sent locally as expected. However other traffic (SCTP) is not. Looking at a packet capture there is no translation done ont he SCTP packets in or out. Is there something I’m missing to force all that traffic to NAT?