Community discussions

MikroTik App
 
_saik0
Member Candidate
Member Candidate
Topic Author
Posts: 127
Joined: Sun Aug 26, 2007 11:18 pm

directed broadcast and nat

Wed Aug 16, 2017 1:12 am

I have a very specific issue, i want to make my dumb aircon to be discoverable outside its broadcast domain.
Basically the APP that does the discovery performs a directed broadcast (they could obviously just use a plain broadcast) inside its subnet and discovers the air con.
After a simple discovery, a regular unicast communication is established between the APP and the aircon.

I wanted to perform dstnat on the ingress packet and direct it to the subnet where the aircon resides (using directed broadcast "helper" address is fine...).

What I'm experiencing is that the dstnat rule actually matches the ingress directed broadcast packet (packet count and log confirms this) but nothing is happening with the packet as if its silently dropped.
Is this the ROS expected behaviour for directed broadcast or I'm missing something?
To note, even with Mikrotik "security policy decision" to block driected broadcast, users SHOULD be able to enable it for specific scenarios!!

current situation:
APP discovery: 10.2.0.20:30000@UDP -> 10.2.0.255:30050
desired situation:
APP discovery: 10.2.0.20:30000@UDP -> 10.2.0.255:30050 -> dstnat -> 10.2.0.20:30000@UDP -> 10.2.2.0/24_l2_bcast:30050
/ip firewall nat
add action=dst-nat chain=dstnat comment=\
    "forward daikin aircon probes to IOT network" dst-address=10.2.0.255 \
    dst-port=30050 in-interface=sfp1.1200 log=yes protocol=udp src-port=30000 \
    to-addresses=10.2.2.244
/ip arp
add address=10.2.2.244 comment="directed broadcast helper address" interface=\
    sfp1.1202 mac-address=FF:FF:FF:FF:FF:FF
/ip address
add address=10.2.0.1/24 interface=sfp1.1200 network=10.2.0.0
add address=10.2.2.1/24 interface=sfp1.1202 network=10.2.2.0
 
Sob
Forum Guru
Forum Guru
Posts: 6079
Joined: Mon Apr 20, 2009 9:11 pm

Re: directed broadcast and nat

Wed Aug 16, 2017 2:48 am

Destination doesn't seem to be important. I tried a quick test and I can't dstnat broadcast packet even to unicast address. Without dstnat, I see it first in prerouting and then in input. When I add dstnat rule, I see packet in prerouting, then dstnat rule gets a hit and I no longer see it in input (that's expected), so dstnat is able to "steal" it. But it isn't in forward either and there isn't any third way to go. I tried to find some info how iptables in Linux deals with it, but all I'm finding is "how do I do it?" and "help, it doesn't work!" stuff.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
_saik0
Member Candidate
Member Candidate
Topic Author
Posts: 127
Joined: Sun Aug 26, 2007 11:18 pm

Re: directed broadcast and nat

Thu Aug 17, 2017 9:46 pm

Can someone from MT comment on this?
 
_saik0
Member Candidate
Member Candidate
Topic Author
Posts: 127
Joined: Sun Aug 26, 2007 11:18 pm

Re: directed broadcast and nat

Tue Nov 07, 2017 11:05 pm

bump
 
_saik0
Member Candidate
Member Candidate
Topic Author
Posts: 127
Joined: Sun Aug 26, 2007 11:18 pm

Re: directed broadcast and nat

Sat Feb 17, 2018 3:22 pm

ancient bump...

Who is online

Users browsing this forum: akbarmunir, cacafaca, fleg, michaels, mozerd, Shoey5, sindy and 169 guests