Community discussions

MikroTik App
 
olivier2831
Member
Member
Topic Author
Posts: 312
Joined: Fri Sep 08, 2017 6:53 pm

PCC example: What does Accept mean in prerouting chain ?

Wed Feb 09, 2022 5:03 pm

Hello,

Looking at [1], there are the following rules :
/ ip firewall mangle
add chain=prerouting dst-address=10.111.0.0/24  action=accept in-interface=LAN
add chain=prerouting dst-address=10.112.0.0/24  action=accept in-interface=LAN
Those are explained with
With policy routing it is possible to force all traffic to the specific gateway, even if traffic is destined to the host (other that gateway) from the connected networks. This way routing loop will be generated and communications with those hosts will be impossible. To avoid this situation we need to allow usage of default routing table for traffic to connected networks.
What does an accept target mean in a prerouting rules ? Does it mean "skippng other prerouting rules" ?

[1] https://wiki.mikrotik.com/wiki/Manual:PCC

Best regards
 
afuchs
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Wed Jul 03, 2019 11:10 am

Re: PCC example: What does Accept mean in prerouting chain ?  [SOLVED]

Wed Feb 09, 2022 5:31 pm

The rules in your mean, that traffic to the IP-address ranges 10.111.0.0/24 and 10.112.0.0/24 that enters the Router of the LAN-Interface will be accepted,
so the following mangle rules did not affect the traffic (first match).
If you do not use such rules it the PCC rules could route your traffic. If you try to reach 10.111.0.1 PCC could decide to send it over 10,112,0,1, because load balancing to WAN, and not directly and this two rules prevent this.
I had one instance where i messed up and send all packages from the internet ride back to, so you try to reach www.goolge.com and you can see that your router get the answer packages, that do his NAT and set the address of your PC as destination and than ... send it to the intent interface out. That wasn't funny.
 
olivier2831
Member
Member
Topic Author
Posts: 312
Joined: Fri Sep 08, 2017 6:53 pm

Re: PCC example: What does Accept mean in prerouting chain ?

Wed Feb 09, 2022 5:58 pm

The rules in your mean, that traffic to the IP-address ranges 10.111.0.0/24 and 10.112.0.0/24 that enters the Router of the LAN-Interface will be accepted,
so the following mangle rules did not affect the traffic (first match).
If you do not use such rules it the PCC rules could route your traffic. If you try to reach 10.111.0.1 PCC could decide to send it over 10,112,0,1, because load balancing to WAN, and not directly and this two rules prevent this.
I had one instance where i messed up and send all packages from the internet ride back to, so you try to reach www.goolge.com and you can see that your router get the answer packages, that do his NAT and set the address of your PC as destination and than ... send it to the intent interface out. That wasn't funny.
Thanks for replying !
This matches what I was suspecting but I wanted to be sure.