Strange issue with port forwarding even if traffic seems on counters

markpap · Fri Jul 09, 2021 10:07 pm

Hello.
I have a strange issue with port forwarding on RB1100AHx4 running RouterOS v6.47.3.
I have done many tests but nothing works, even if everything seems right.
I try to access a Unifi Cloud Key device from outside, but unfortunately I cannot.

Unifi Cloud Key has local ip: 10.1.0.8 and port 8443 (as it is its default).

My setup:

1    chain=forward action=accept protocol=tcp dst-address=10.1.0.8 dst-port=8443 log=yes log-prefix="fire6001-" 

2    chain=forward action=accept connection-nat-state=dstnat

Because of logging, this is what I have in log file:

fire6001- forward: in:pppoe-out3 out:bridge1-hotel, proto TCP (SYN), 94.65.254.177:53853->10.1.0.8:8443, NAT 94.65.254.177:53853->(100.81.149.113:22201->10.1.0.8:8443), len 52

where: 94.65.254.177 is my dynamic public ip from the outside pc that I try to access Cloud Key, 100.81.149.113 is the dynamic public ip from the router that is installed the Cloud Key.
Port 22201 is redirecting to 8443 as you may see on my NAT rules below:

 0    chain=dstnat action=dst-nat to-addresses=10.1.0.8 to-ports=8443 protocol=tcp in-interface=pppoe-out3 dst-port=22201 log=yes log-prefix="natlog-" 

 1    chain=dstnat action=dst-nat to-addresses=10.1.0.8 to-ports=443 protocol=tcp in-interface=pppoe-out3 dst-port=22201 port="" log=no log-prefix=""

where: pppoe-out3 is my WAN interface.

Because of logging, this is what I have in log file:

natlog- dstnat: in:pppoe-out3 out:(unknown 0), proto TCP (SYN), 94.65.251.3:63518->100.81.149.113:22201, len 52

Moreover, I try to use and log mangle rules:

0    chain=prerouting action=passthrough protocol=tcp in-interface=pppoe-out3 dst-port=22201 log=yes log-prefix="mangle-"

Because of logging, this is what I have in log file:

mangle- prerouting: in:pppoe-out3 out:(unknown 0), src-mac 08:96:ad:2e:4d:ea, proto TCP (RST), 94.65.251.3:63518->100.81.149.113:22201, NAT 94.65.251.3:63518->(100.81.149.113:22201->10.1.0.8:8443), len 40

Even if in log file, everything seems to be fine, I cannot access my Unifi Cloud Key at all. I had tried to access it from too many different devices and networks outside, but with no luck.

Any ideas????

anav · Fri Jul 09, 2021 10:30 pm

(1) In terms of forward firewall chain you only need one rule. Get rid of the other rule you made.

keep this one!
add action=accept chain=forward comment="Allow Port Forwarding" \
connection-nat-state=dstnat connection-state=new in-interface-list=WAN

** ensure that ppoe-out3 is listed on your interface members list.

/interface list member
...
add interface=pppoe- out3 list=WAN

(2) Then you need to have a dstnat rule.
If the associated wan ISP is dynamic and I believe that PPOE is considered dynamic then you can use the rule you have.

(3) The only other issue to contemplate is if your want yourself and users IN THE SAME LAN SUBNET AS THE SERVER, to be able to reach the server by your routers Public IP ( via domain name for example). If this is the case it will not be possible without some changes. The easiest fix is to move the SERVER to its own subnet, problem solved.
If not then you will need to add a sourcenat rule and modify the above dstnat rule.

sindy · Fri Jul 09, 2021 11:05 pm

All your logging shows that the initial SYN packet from the internet has been properly redirected and let through to the server. So the questions are whether
a) the Unifi Cloud Key has a default route, and if yes, whether its gateway is Mikrotik's IP address in 10.1.0.x,
b) the Unifi Cloud Key itself doesn't use an access list, making it ignore traffic from some clients.

The TCP RST in mangle prerouting suggests that the TCP connection has been established and then dropped. So I'd recommend to run
/tool sniffer quick ip-address=10.1.0.8 port=8843

Then try another connection from the remote PC; once it fails, stop the /tool sniffer, and then use /tool sniffer packet print detail to see whether the communication was bi-directional or uni-directional. If in doubt, post the result here.

markpap · Sat Jul 10, 2021 12:01 am

(1) In terms of forward firewall chain you only need one rule. Get rid of the other rule you made.

keep this one!
add action=accept chain=forward comment="Allow Port Forwarding" \
connection-nat-state=dstnat connection-state=new in-interface-list=WAN

** ensure that ppoe-out3 is listed on your interface members list.

/interface list member
...
add interface=pppoe- out3 list=WAN

I have done the above and I have as a result in log:

firenat2- forward: in:pppoe-out3 out:bridge1-hotel, proto TCP (SYN), 94.65.251.3:62443->10.1.0.8:8443, NAT 94.65.251.3:62443->(100.81.149.113:22201->10.1.0.8:8443), len 52

but no luck to reach my device remotely.

(2) Then you need to have a dstnat rule.
If the associated wan ISP is dynamic and I believe that PPOE is considered dynamic then you can use the rule you have.

Yes, my Public IP is dynamic and I use ddns.

(3) The only other issue to contemplate is if your want yourself and users IN THE SAME LAN SUBNET AS THE SERVER, to be able to reach the server by your routers Public IP ( via domain name for example). If this is the case it will not be possible without some changes. The easiest fix is to move the SERVER to its own subnet, problem solved.
If not then you will need to add a sourcenat rule and modify the above dstnat rule.

I don't need something like that as I just need to reach my device from outside, but please send me an example, how to do that, after solving my main issue.

All your logging shows that the initial SYN packet from the internet has been properly redirected and let through to the server. So the questions are whether
a) the Unifi Cloud Key has a default route, and if yes, whether its gateway is Mikrotik's IP address in 10.1.0.x,
b) the Unifi Cloud Key itself doesn't use an access list, making it ignore traffic from some clients.

a) Unifi Cloud Key has default route and its gateway is Mikrotik IP (10.1.0.1).
b) I didn't understand that.

The TCP RST in mangle prerouting suggests that the TCP connection has been established and then dropped. So I'd recommend to run
/tool sniffer quick ip-address=10.1.0.8 port=8843

Then try another connection from the remote PC; once it fails, stop the /tool sniffer, and then use /tool sniffer packet print detail to see whether the communication was bi-directional or uni-directional. If in doubt, post the result here.

/tool sniffer packet print detail returns nothing.

markpap · Sat Jul 10, 2021 3:17 am

Finally, /tool sniffer quick ip-address=10.1.0.8 port=8843 works, as port is 8443 and not 8843.

Below are the results, where I found tcp-flags=rst.

84 time=20.865 num=85 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:62674 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=58745 fragment-offset=0 ttl=119 tcp-flags=syn 

85 time=20.865 num=86 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:62674 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=58745 fragment-offset=0 ttl=119 tcp-flags=syn 

86 time=20.865 num=87 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:62674 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

87 time=20.865 num=88 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:62674 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

88 time=20.892 num=89 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:62674 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

89 time=20.892 num=90 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:62674 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 [b]tcp-flags=rst[/b]

The most strange thing is that when I connect to this router using PPPoE VPN, from outside and I try to visit Unifi Cloud Key, everything works fine and Packet Sniffer has as results:

166 time=24.365 num=192 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=172.19.0.3:59265 protocol=ip ip-protocol=tcp size=1494 cpu=0 fp=no ip-packet-size=1480 
   ip-header-size=20 dscp=0 identification=36191 fragment-offset=0 ttl=64 tcp-flags=ack 

167 time=24.365 num=193 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=172.19.0.3:59265 protocol=ip ip-protocol=tcp size=1409 cpu=0 fp=no ip-packet-size=1395 
   ip-header-size=20 dscp=0 identification=36192 fragment-offset=0 ttl=64 tcp-flags=psh,ack 

168 time=24.365 num=194 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=172.19.0.3:59265 protocol=ip ip-protocol=tcp size=1409 cpu=0 fp=no ip-packet-size=1395 
   ip-header-size=20 dscp=0 identification=36192 fragment-offset=0 ttl=64 tcp-flags=psh,ack 

169 time=24.389 num=195 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=172.19.0.3:59265 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=2>
   dscp=0 identification=31965 fragment-offset=0 ttl=126 tcp-flags=ack 

170 time=24.389 num=196 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=172.19.0.3:59265 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=31965 fragment-offset=0 ttl=126 tcp-flags=ack 

171 time=24.389 num=197 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=172.19.0.3:59265 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=2>
   dscp=0 identification=31966 fragment-offset=0 ttl=126 tcp-flags=ack

Any ideas????

sindy · Sat Jul 10, 2021 9:05 am

The sniff shows that the Unifi Cloud Key did respond with SYN,ACK to the SYN an the RST came from the client side. So we can be sure that no access list or missing route at the Unifi Cloud Key are the reason of the failure.

What surprises me is that the packet numbering starts from 84, what was happening there before?

The thing is that if there was just a single SYN from the client followed by a single SYN,ACK from the server and then immediately (in 30 ms) followed by a RST from client side, it was most likely some firewall between the client and your Mikrotik that has forged the RST on behalf of the client.

If there were multiple SYNs responded with SYN,ACKs from the server before the RST came, it could be that the SYN,ACKs did not make it to the client and thus the client was resending the SYN for a while, and then gave up and sent the RST on its own.

So I'd say repeat the same scenario, this time sniffing on port=22201 ip-address=94.65.251.3 (or what the actual address of the client will be at the time of the test), to see whether the SYN,ACK responses seen at the LAN side do make it to the WAN side, and if they do, to see whether there is just a single SYN responded with a single SYN,ACK before the RST arrives or whether it's the scenario described above, except that the SYN,ACK delivery fails outside the Mikrotik.

markpap · Sat Jul 10, 2021 11:23 am

Here are the full results of: /tool sniffer quick ip-address=10.1.0.8 port=8443

 0 time=2.82 num=1 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35394 fragment-offset=0 ttl=119 tcp-flags=syn 

 1 time=2.82 num=2 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35394 fragment-offset=0 ttl=119 tcp-flags=syn 

 2 time=2.82 num=3 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

 3 time=2.82 num=4 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

 4 time=2.82 num=5 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35393 fragment-offset=0 ttl=119 tcp-flags=syn 

 5 time=2.82 num=6 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35393 fragment-offset=0 ttl=119 tcp-flags=syn 

 6 time=2.821 num=7 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

 7 time=2.821 num=8 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

 8 time=2.848 num=9 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

 9 time=2.848 num=10 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

10 time=2.849 num=11 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

11 time=2.849 num=12 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

12 time=3.023 num=13 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35395 fragment-offset=0 ttl=119 tcp-flags=syn 

13 time=3.023 num=14 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35395 fragment-offset=0 ttl=119 tcp-flags=syn 

14 time=3.023 num=15 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

15 time=3.023 num=16 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

16 time=3.052 num=17 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

17 time=3.052 num=18 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

18 time=3.834 num=19 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35396 fragment-offset=0 ttl=119 tcp-flags=syn 

19 time=3.834 num=20 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35396 fragment-offset=0 ttl=119 tcp-flags=syn 

20 time=3.834 num=21 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

21 time=3.834 num=22 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

22 time=3.834 num=23 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35397 fragment-offset=0 ttl=119 tcp-flags=syn 

23 time=3.834 num=24 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35397 fragment-offset=0 ttl=119 tcp-flags=syn 

24 time=3.834 num=25 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

25 time=3.834 num=26 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

26 time=3.863 num=27 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

27 time=3.863 num=28 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

28 time=3.863 num=29 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

29 time=3.863 num=30 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

30 time=4.036 num=31 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35398 fragment-offset=0 ttl=119 tcp-flags=syn 

31 time=4.036 num=32 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35398 fragment-offset=0 ttl=119 tcp-flags=syn 

32 time=4.036 num=33 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

33 time=4.036 num=34 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

34 time=4.064 num=35 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

35 time=4.064 num=36 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

36 time=5.843 num=37 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35399 fragment-offset=0 ttl=119 tcp-flags=syn 

37 time=5.843 num=38 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35399 fragment-offset=0 ttl=119 tcp-flags=syn 

38 time=5.844 num=39 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

39 time=5.844 num=40 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

40 time=5.844 num=41 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35400 fragment-offset=0 ttl=119 tcp-flags=syn 

41 time=5.844 num=42 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35400 fragment-offset=0 ttl=119 tcp-flags=syn 

42 time=5.844 num=43 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

43 time=5.844 num=44 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

44 time=5.871 num=45 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

45 time=5.871 num=46 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

46 time=5.872 num=47 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

47 time=5.872 num=48 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

48 time=6.047 num=49 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35401 fragment-offset=0 ttl=119 tcp-flags=syn 

49 time=6.047 num=50 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35401 fragment-offset=0 ttl=119 tcp-flags=syn 

50 time=6.047 num=51 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

51 time=6.047 num=52 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

52 time=6.076 num=53 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

53 time=6.076 num=54 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

54 time=9.849 num=55 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35402 fragment-offset=0 ttl=119 tcp-flags=syn 

55 time=9.849 num=56 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35402 fragment-offset=0 ttl=119 tcp-flags=syn 

56 time=9.849 num=57 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35403 fragment-offset=0 ttl=119 tcp-flags=syn 

57 time=9.849 num=58 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35403 fragment-offset=0 ttl=119 tcp-flags=syn 

58 time=9.849 num=59 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

59 time=9.849 num=60 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

60 time=9.85 num=61 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

61 time=9.85 num=62 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

62 time=9.877 num=63 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

63 time=9.877 num=64 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

64 time=9.878 num=65 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

65 time=9.878 num=66 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

66 time=10.053 num=67 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35404 fragment-offset=0 ttl=119 tcp-flags=syn 

67 time=10.053 num=68 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35404 fragment-offset=0 ttl=119 tcp-flags=syn 

68 time=10.053 num=69 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

69 time=10.053 num=70 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

70 time=10.081 num=71 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

71 time=10.081 num=72 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

72 time=17.856 num=73 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35405 fragment-offset=0 ttl=119 tcp-flags=syn 

73 time=17.856 num=74 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35405 fragment-offset=0 ttl=119 tcp-flags=syn 

74 time=17.856 num=75 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

75 time=17.856 num=76 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:56811 protocol=ip ip-protocol=tcp size=66 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

76 time=17.857 num=77 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35406 fragment-offset=0 ttl=119 tcp-flags=syn 

77 time=17.857 num=78 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35406 fragment-offset=0 ttl=119 tcp-flags=syn 

78 time=17.857 num=79 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

79 time=17.857 num=80 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:60664 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

80 time=17.884 num=81 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

81 time=17.884 num=82 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:56811 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

82 time=17.887 num=83 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

83 time=17.887 num=84 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:60664 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

84 time=18.069 num=85 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=35407 fragment-offset=0 ttl=119 tcp-flags=syn 

85 time=18.069 num=86 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=66 cpu=0 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=35407 fragment-offset=0 ttl=119 tcp-flags=syn 

86 time=18.07 num=87 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=ether6-unifi-controller src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

87 time=18.07 num=88 direction=rx src-mac=FC:EC:DA:04:F9:0C dst-mac=CC:2D:E0:76:D8:A4 interface=bridge1-hotel src-address=10.1.0.8:8443 dst-address=94.65.251.3:59633 protocol=ip ip-protocol=tcp size=66 cpu=3 fp=no ip-packet-size=52 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=64 tcp-flags=syn,ack 

88 time=18.114 num=89 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=bridge1-hotel src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 
   dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst 

89 time=18.114 num=90 direction=tx src-mac=CC:2D:E0:76:D8:A4 dst-mac=FC:EC:DA:04:F9:0C interface=ether6-unifi-controller src-address=94.65.251.3:59633 dst-address=10.1.0.8:8443 protocol=ip ip-protocol=tcp size=54 cpu=0 fp=no ip-packet-size=40 
   ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=55 tcp-flags=rst

And here are the results of: /tool sniffer quick ip-address=94.65.251.3 port=22201

 0 time=3.541 num=1 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35408 fragment-offset=0 
   ttl=120 tcp-flags=syn 

 1 time=3.541 num=2 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35409 fragment-offset=0 
   ttl=120 tcp-flags=syn 

 2 time=3.541 num=3 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:54607 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

 3 time=3.541 num=4 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:63252 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

 4 time=3.57 num=5 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

 5 time=3.57 num=6 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

 6 time=3.74 num=7 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35410 fragment-offset=0 
   ttl=120 tcp-flags=syn 

 7 time=3.741 num=8 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:50611 protocol=ip ip-protocol=tcp size=52 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

 8 time=3.769 num=9 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

 9 time=4.549 num=10 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35412 fragment-offset=0 
   ttl=120 tcp-flags=syn 

10 time=4.549 num=11 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35411 fragment-offset=0 
   ttl=120 tcp-flags=syn 

11 time=4.55 num=12 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:54607 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

12 time=4.55 num=13 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:63252 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

13 time=4.578 num=14 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

14 time=4.578 num=15 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

15 time=4.755 num=16 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35413 fragment-offset=0 
   ttl=120 tcp-flags=syn 

16 time=4.756 num=17 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:50611 protocol=ip ip-protocol=tcp size=52 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

17 time=4.784 num=18 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

18 time=6.564 num=19 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35415 fragment-offset=0 
   ttl=120 tcp-flags=syn 

19 time=6.564 num=20 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35414 fragment-offset=0 
   ttl=120 tcp-flags=syn 

20 time=6.565 num=21 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:54607 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

21 time=6.565 num=22 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:63252 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

22 time=6.593 num=23 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

23 time=6.593 num=24 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

24 time=6.757 num=25 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35416 fragment-offset=0 
   ttl=120 tcp-flags=syn 

25 time=6.757 num=26 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:50611 protocol=ip ip-protocol=tcp size=52 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

26 time=6.785 num=27 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

27 time=10.575 num=28 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35418 fragment-offset=0 
   ttl=120 tcp-flags=syn 

28 time=10.575 num=29 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35417 fragment-offset=0 
   ttl=120 tcp-flags=syn 

29 time=10.575 num=30 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:54607 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

30 time=10.575 num=31 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:63252 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

31 time=10.603 num=32 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

32 time=10.603 num=33 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

33 time=10.766 num=34 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35419 fragment-offset=0 
   ttl=120 tcp-flags=syn 

34 time=10.766 num=35 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:50611 protocol=ip ip-protocol=tcp size=52 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

35 time=10.794 num=36 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

36 time=18.583 num=37 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35420 fragment-offset=0 
   ttl=120 tcp-flags=syn 

37 time=18.583 num=38 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:54607 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

38 time=18.584 num=39 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35421 fragment-offset=0 
   ttl=120 tcp-flags=syn 

39 time=18.584 num=40 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:63252 protocol=ip ip-protocol=tcp size=52 cpu=2 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

40 time=18.611 num=41 direction=rx interface=pppoe-out3 src-address=94.65.251.3:54607 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

41 time=18.612 num=42 direction=rx interface=pppoe-out3 src-address=94.65.251.3:63252 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst 

42 time=18.774 num=43 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=52 cpu=0 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=35422 fragment-offset=0 
   ttl=120 tcp-flags=syn 

43 time=18.774 num=44 direction=tx interface=pppoe-out3 src-address=100.73.232.47:22201 dst-address=94.65.251.3:50611 protocol=ip ip-protocol=tcp size=52 cpu=1 fp=no ip-packet-size=52 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=63 
   tcp-flags=syn,ack 

44 time=18.802 num=45 direction=rx interface=pppoe-out3 src-address=94.65.251.3:50611 dst-address=100.73.232.47:22201 protocol=ip ip-protocol=tcp size=42 cpu=0 fp=no ip-packet-size=40 ip-header-size=20 dscp=0 identification=0 fragment-offset=0 ttl=56 
   tcp-flags=rst

Any ideas???

sindy · Sat Jul 10, 2021 12:43 pm

Any ideas???

The sniff from the WAN side clearly shows that something (most likely a firewall) on the path between the client and the Mikrotik is forging the RST packets on behalf of the client.

If you only look at the packets with the same client-side port, you can see that the client sends the SYN multiple times with an exponentially growing delay (1s, 2s, 4s, 8s) from the same port, which means that the SYN,ACK do not reach the client. The RST arrives "in response" to each SYN,ACK, which means that it is not a "give up" message from the client.

You'd need to sniff to a file and inspect it using Wireshark to see whether there is something unusual in the SYN,ACK packets that some security device considers harmful.

markpap · Sat Jul 10, 2021 3:06 pm

First of all, thanks for your direct help.

I have disabled any firewall to the whole path (remote mikrotik router, pc, etc) but nothing changed.

it's too strange all this behavior

sindy · Sat Jul 10, 2021 4:11 pm

Disabling firewalls is never a good idea.

The fastest way to diagnose any network problem (and many other kinds of technical problems too) is recursive cutting of the path between endpoints into halves to find the problematic part of the path.

Since you have a Mikrotik router also at the client side, you can sniff there too, to see whether the RST packets are generated by that router or not.

Strange issue with port forwarding even if traffic seems on counters

Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Re: Strange issue with port forwarding even if traffic seems on counters

Who is online