Disabling the first action=src-nat rule, with out-interface=*FFFFFFFF actually solved the problem but I don't understand why. This is default rule.
IIRC, an interface pointing to *FFFF points to an interface that does not exist anymore, i.e. deleted
That's exactly the reason why I wanted to see the output of the print
before the rule was disabled. Whereas *23f
and similar hex numbers prefixed with a star are really links to objects which have been removed from the configuration in the meantime, *0
have a special meaning in some parts of the configuration, which is "the first element in the list" and "the last element in the list" (except that you don't know which one is actually the first one and which one is last).
So I wanted to have this confirmed in this case, and indeed the print
has revealed that the *FFFFFFFF
from the configuration data has been translated to a normal interface ID whose name is, in this case, ether1-gateway
I wasn't expecting it to be ether1-gateway
, I was actually expecting it to be bridge-local
or no interface at all, but that's another thing.
Not knowing your network topology, and since you posted only the part of configuration which you deemed relevant, I can only give generic explanations.
If you really connect to internet using /interface pppoe client
, then its carrying L2 interface in typical cases doesn't have any IP configuration attached to it, so it is non-existent for the firewall. It is not a law, though, you can use the same (V)LAN to carry PPPoE traffic and one or more IP subnets simultaneously.
In any case, the rule I've asked you to disable was causing packets coming from the PPTP client to be src-nated to Mikrotik's own address attached to the L3 interface through which they were forwarded to the NFS server. By disabling the rule, this stopped happening and the NFS server can see the actual PPTP-assigned address of the client.
Whether disabling the rule has fixed the original issue but broken something else instead is a separate question, it depends on whether your L3 uplink to internet is pppoe-out1
or really ether1-gateway
. So if it did, you have to replace it with a more selective one.
And how comes that a default rule ends up with *FFFFFFFF
as an interface ID is another separate question which I cannot answer.