Community discussions

MikroTik App
  4. RouterOS
  5. General

How to change destination ip address

Post Reply
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

How to change destination ip address

Fri Sep 28, 2018 11:02 am

Dear all,
I have a Mikrotik device with these interfaces:
1) eth1 used for internal lan (10.115.4.254/24)
2) lte1 that connect mikrotik device to internet (dynamic ip address provided by internet provider)
3) sstp-out1 virtual interface for a private sstp vpn tunnel

At eth1 there is attached a single device (10.115.4.1) that for reasons now I don't explain send udp data packet to 10.115.4.254:32000.
With torch tool I see these udp packet arriving to eth1 interface and then I would to redirect them to another ip address reachable by sstp-out1connection (10.230.10.3). Then I configured a dnat rule beacuse I think is the right way to do this operation but the new ip address never receive these packet. With torch tool I never see these packet on lte1 interface. Where is the mistake?

I configured this rule:
Code: Select all
 ip firewall nat print 
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=dstnat action=dst-nat to-addresses=10.230.10.3 to-ports=32000 protocol=udp src-address=10.115.4.1 dst-address=10.115.4.254 dst-port=32000 log=no log-prefix=""


Thanks in advance
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Fri Sep 28, 2018 12:43 pm

The most likely cause is that your rules in chain=forward of /ip firewall filter do not let the dst-nated packet through.

Other than that, the to-ports parameter in the dst-nat rule is redundant (you don't change the port so no need to specify the new value), but it is not the cause why you cannot see the packet leave via the SSTP interface.
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Fri Sep 28, 2018 12:49 pm

Hi sindy it is always a pleasure hear you. :-)
In any case the ip firewall filter is empty :-). All traffic in input, output and forward is allowed.

For the port ... oh yes it is redundant. :-)


The most likely cause is that your rules in chain=forward of /ip firewall filter do not let the dst-nated packet through.

Other than that, the to-ports parameter in the dst-nat rule is redundant (you don't change the port so no need to specify the new value), but it is not the cause why you cannot see the packet leave via the SSTP interface.
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Fri Sep 28, 2018 1:03 pm

Well, I did not read carefully enough your problem description, there is some unclarity in it. You say that the new destination address 10.230.10.3 should be reachable via sstp-out1 but at the same time you say you cannot see the dst-nated packet when torching at interface lte1.

As you haven't shown your torch filter settings: the packet with new destination address 10.230.10.3 should be seen when torching on sstp-out1; when torching on lte-1, the encrypted version of that packet should be seen as well, but it definitely won't have destination address 10.230.10.3.
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Fri Sep 28, 2018 1:25 pm

Oh sorry. The new destination address is reachable through lte1 interfaces (please don't assume sstp-out1). In any case you assume that I reach 10.230.10.3 through lte1. From mikrotik device I ping correctly 10.230.10.3 through lte1.
Well, I did not read carefully enough your problem description, there is some unclarity in it. You say that the new destination address 10.230.10.3 should be reachable via sstp-out1 but at the same time you say you cannot see the dst-nated packet when torching at interface lte1.

As you haven't shown your torch filter settings: the packet with new destination address 10.230.10.3 should be seen when torching on sstp-out1; when torching on lte-1, the encrypted version of that packet should be seen as well, but it definitely won't have destination address 10.230.10.3.
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Fri Sep 28, 2018 1:33 pm

In that case please post an export of the complete configuration.
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Fri Sep 28, 2018 1:38 pm

Code: Select all
/interface bridge
add fast-forward=no name=bridge1
/interface ethernet
set [ find default-name=ether1 ] comment=CYGNO speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
/interface lte
set [ find ] mac-address=XX:XX:XX:XX:XX:XX name=lte1
/interface sstp-client
add authentication=mschap2 connect-to=10.230.10.31 disabled=no keepalive-timeout=10 name=sstp-out1 user=celi
/interface lte apn
set [ find default=yes ] apn=XXXXXXXXXXXX default-route-distance=1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge1 interface=ether1 trusted=yes
add bridge=bridge1 interface=ether2 trusted=yes
add bridge=bridge1 interface=ether3 trusted=yes
/ip address
add address=10.115.4.254/24 interface=bridge1 network=10.115.4.0
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=10.115.4.254 dst-port=32000 protocol=udp src-address=10.115.4.1 to-addresses=10.230.10.3 to-ports=32000
add action=dst-nat chain=dstnat dst-port=8080 in-interface=sstp-out1 protocol=tcp to-addresses=10.115.4.3 to-ports=8080
add action=dst-nat chain=dstnat dst-port=5001 in-interface=sstp-out1 protocol=tcp to-addresses=10.115.4.3 to-ports=5001
add action=dst-nat chain=dstnat dst-port=9000 in-interface=sstp-out1 protocol=tcp to-addresses=10.115.4.100 to-ports=23
add action=masquerade chain=srcnat src-address=10.115.4.0/24
/system identity
set name=CELI
/system ntp client
set enabled=yes primary-ntp=10.230.10.31
/system routerboard settings
set silent-boot=no
/system scheduler
add interval=1h name=reset-lte on-event="/system script run reset-lte" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon start-time=startup
/system script
add dont-require-permissions=no name=reset-lte owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":log info \"Controllo connessione\"\r\
    \n:if ([/ping count=10 interval=00:00:02 172.17.10.1] = 0) do={\r\
    \n:log info \"Connessione down. Eseguo USB Power reset\"\r\
    \n/system routerboard usb power-reset bus=1 duration=10s\r\
    \n} else={ :log info \"Connessione OK\"  }"
In that case please post an export of the complete configuration.
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Fri Sep 28, 2018 1:45 pm

/ip address print and /ip route print, please.
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Fri Sep 28, 2018 3:48 pm

Code: Select all
ip address print 
Flags: X - disabled, I - invalid, D - dynamic 
 #   ADDRESS            NETWORK         INTERFACE                                
 0   10.115.4.254/24    10.115.4.0      bridge1                                  
 1 D 192.168.90.153/30  192.168.90.152  lte1                                     
 2 D 172.17.10.56/32    172.17.10.1     sstp-out1
Code: Select all
ip route print 
Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 ADS  0.0.0.0/0                          192.168.90.154            1
 1 ADC  10.115.4.0/24      10.115.4.254    bridge1                   0
 2 ADC  172.17.10.1/32     172.17.10.56    sstp-out1                 0
 3 ADC  192.168.90.152/30  192.168.90.153  lte1                      0
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Fri Sep 28, 2018 4:44 pm

I can see nothing what would explain what you describe.

Does your action=dst-nat rule show a non-zero packet count (/ip firewall nat print stats where dst-port="32000")?
If yes, what does /ip firewall connection print detail where dst-address~":32000" show while the device attempts to send to 10.115.4.254:32000?
What is your exact torch filter? Can you use a packet sniffer as below instead?

/tool sniffer set filter-ip-protocol=udp filter-port=32000 filter-interface=lte1 filter-operator-between-entries=and filter-mac-address="" filter-mac-protocol="" filter-ip-address="" filter-ipv6-address="" filter-cpu=""
/tool sniffer start
/tool sniffer packet print detail interval=1s
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Mon Oct 01, 2018 3:58 pm

Dear sindy,
on lte1 interface I don't see nothing. I don't understand what happens when mikrotik router receive udp packet on its ether1 interface.
I attach you a sniffer on ether1 interface. As you can see packets are correctly received by mikrotik but I don't understand how it manipulate them.
Code: Select all
 1 time=0.903 num=2 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43526 fragment-offset=0 ttl=64 

 2 time=1.414 num=3 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43528 fragment-offset=0 ttl=64 

 3 time=1.591 num=4 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43530 fragment-offset=0 ttl=64 

 4 time=1.645 num=5 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43532 fragment-offset=0 ttl=64 

 5 time=2.136 num=6 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43534 fragment-offset=0 ttl=64 

 6 time=2.802 num=7 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43536 fragment-offset=0 ttl=64 

 7 time=3.134 num=8 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43538 fragment-offset=0 ttl=64 

 8 time=3.655 num=9 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43540 fragment-offset=0 ttl=64 

 9 time=3.837 num=10 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43542 fragment-offset=0 ttl=64 

10 time=3.885 num=11 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43544 fragment-offset=0 ttl=64 

11 time=4.212 num=12 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=194 cpu=1 fp=no ip-packet-size=180 ip-header-size=20 
   dscp=0 identification=43546 fragment-offset=0 ttl=64 

12 time=4.375 num=13 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43548 fragment-offset=0 ttl=64 

13 time=5.035 num=14 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43550 fragment-offset=0 ttl=64 

14 time=5.375 num=15 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43552 fragment-offset=0 ttl=64 

15 time=5.902 num=16 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43554 fragment-offset=0 ttl=64 

16 time=6.068 num=17 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43556 fragment-offset=0 ttl=64 

17 time=6.123 num=18 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43558 fragment-offset=0 ttl=64 

18 time=6.617 num=19 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43560 fragment-offset=0 ttl=64 

19 time=7.279 num=20 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43562 fragment-offset=0 ttl=64 

20 time=7.618 num=21 direction=rx src-mac=00:11:40:01:06:2A dst-mac=CC:2D:E0:E8:A0:EE interface=ether1 src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 protocol=ip ip-protocol=udp size=330 cpu=1 fp=no ip-packet-size=316 ip-header-size=20 
   dscp=0 identification=43564 fragment-offset=0 ttl=64
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Mon Oct 01, 2018 4:19 pm

So please switch on logging on the dst-nat rule:
/ip firewall nat set [find faction="dst-nat" to-ports="32000"] log=yes log-prefix="dstnat rule: "
and add the following filter rules:
/ip firewall filter add chain=forward action=log log-prefix="filter rule forward: " dst-port=32000
/ip firewall filter add chain=input action=log log-prefix="filter rule input: " dst-port=32000

then, disconnect the "client" device, wait for 4 minutes, run /log print follow-only where topics~"firewall" and message~"rule", and connect the "client". You should see there what RouterOS is doing with those packets. After collecting a few lines in this log, press Ctrl-C, post the output, and also the output of the following command (if not empty):
/ip firewall connection print detail where dst-address~":32000"
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Mon Oct 01, 2018 4:32 pm

Then:
Code: Select all
[admin@CELI] > /log print follow-only where topics~"firewall" and message~"rule"
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT 10.115.4.1:32000->(10.115.4.254:32000->10.230.10.3:32000), len 316 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 180
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 78 
13:29:58 firewall,info filter rule forward:  forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:58 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:59 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 384
 
13:29:59 firewall,info filter rule forward:  forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66 
13:29:59 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:59 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:59 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 384
 
13:29:59 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:29:59 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66 
13:30:00 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66 
13:30:00 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:00 firewall,info filter rule forward:  forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:01 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316
 
13:30:02 firewall,info filter rule forward:  forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 316

And :
Code: Select all
[admin@CELI] > /ip firewall connection print detail where dst-address~":32000"
Flags: E - expected, S - seen-reply, A - assured, C - confirmed, D - dying, F - fasttrack, s - srcnat, d - dstnat 
 0  SAC  sd protocol=udp src-address=10.115.4.1:32000 dst-address=10.115.4.254:32000 reply-src-address=10.230.10.3:32000 reply-dst-address=192.168.90.153:32000 timeout=2m59s orig-packets=473 orig-bytes=146 850 orig-fasttrack-packets=0 
            orig-fasttrack-bytes=0 repl-packets=6 repl-bytes=396 repl-fasttrack-packets=0 repl-fasttrack-bytes=0 orig-rate=7.5kbps repl-rate=0bps
Top
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to change destination ip address

Mon Oct 01, 2018 5:30 pm

According to these results, everything works except torch/sniffer at lte1 interface and maybe except the remote side (no idea what your protocol is expected to do so the large asymetry between packets sent and received may be normal):

13:29:59 firewall,info filter rule forward: forward: in:bridge1(ether1) out:lte1, src-mac 00:11:40:01:06:2a, proto UDP, 10.115.4.1:32000->10.230.10.3:32000, NAT (10.115.4.1:32000->192.168.90.153:32000)->(10.115.4.254:32000->10.230.10.3:32000), len 384

13:29:59 firewall,info filter rule forward: forward: in:lte1 out:bridge1, src-mac 4c:54:99:45:e5:d5, proto UDP, 10.230.10.3:32000->10.115.4.1:32000, NAT (10.230.10.3:32000->10.115.4.254:32000)->(192.168.90.153:32000->10.115.4.1:32000), len 66


The log shows in and out interfaces which are the expected ones, and the NAT part shows which transformations are used for source address and destination address of each packet.

The connection printout also shows everything to run smoothly at UDP level - both orig packets and reply packets were seen and thuse the followng flags are set:
S - seen-reply, A - assured, C - confirmed, s - srcnat, d - dstnat

src-address=10.115.4.1:32000 <=> reply-dst-address=192.168.90.153:32000 (this transformation has been created by the action=masquerade rule)
dst-address=10.115.4.254:32000 <-> reply-src-address=10.230.10.3:32000 (this transformation has been created by the action=dst-nat rule)

orig-packets=473
orig-bytes=146 850
orig-fasttrack-packets=0
orig-fasttrack-bytes=0
orig-rate=7.5kbps

repl-packets=6
repl-bytes=396
repl-fasttrack-packets=0
repl-fasttrack-bytes=0
repl-rate=0bps


The question is whether the remote side is sending only in response to what it receives from the local side, or whether it is sending regardless whether it receives something from the local side; in any case, you should see at least the incoming packets from the remote side if the ones sent by local one would be mysteriously disappearing between firewall filter and the lte1 interface.
Top
 
leon84
Member Candidate
Member Candidate
Topic Author
Posts: 201
Joined: Wed Dec 02, 2009 12:15 pm

Re: How to change destination ip address

Mon Oct 01, 2018 5:37 pm

Dear sindy now run all correctly! The only change I made is: disabling and enabling ether1 interface and I think this operation solved the issue. Now I see packet also in lte1 interface!
Top
Post Reply

Who is online

Users browsing this forum: Google [Bot], maigonis, mbovenka, mquan1984, scsiii, voljka and 113 guests
  4. RouterOS
  5. General