I upgraded to 6.37rc and that has fixed it.

Thanks.

I am running v6.36 on a RB SXT 5HnD and noticed that the timeout values for connections in IPv6/firewall/connections increase rather than decrease. So the timeout timers will never decrement to 0 for IPv6 connections. The timeout values for IPv4 connections in IPv4/firewall/connections do decrease. ...

I haven't tested this yet but in theory you should be able to put our outbound port in a separate bridge (not the same bridge as the incoming port) and then apply a drop action in the srcnat chain ( you will want an accept action for packets with a source IP of your MikroTik router).

Other postings have mentioned that if you use a bridge you need to set the bridge to use-ip-firewall=yes for the netflow to work. I didn't get that to work but didn't do extensive testing of that setup. I do have a setup that works for me but am seeing the netflow sequence error mentioned in other p...