Page 1 of 1

Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Wed Apr 26, 2017 11:32 pm
by radnet
dear all

when user are going to send request to mail.abcde.com:80 , i want that user's request forward to mail.abcde.com:8080 directly.
in other word when domain is exactly 'mail.abcde.com' (not for other domain) this process to be happened.

i have done this issue in 3 step :

Step 1 : Create Layer7 Protocol :

# NAME REGEXP
0 mail.abcde.com ^.+(mail.abcde.com).*$

STEP 2 : Create a Mangle
chain=prerouting action=mark-connection new-connection-mark=MailServerConnection passthrough=no layer7-protocol=mail.abcde.com protocol=tcp log=no log-prefix=""

STEP 3 : Create NAT
chain=dstnat action=dst-nat to-addresses=192.168.100.100 to-ports=8080 protocol=tcp dst-address=MY_PUBLIC_IP connection-mark=MailServerConnection dst-port=80 log=no log-prefix=""

Mangle are receiving packets when user are going to send request to mail.abcde.com:80 but NAT not working !

any idea?

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Thu Apr 27, 2017 8:01 pm
by radnet
any idea ????

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Thu Apr 27, 2017 8:39 pm
by Sob
It doesn't work like this. See e.g. this thread about similar problem.

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Fri Apr 28, 2017 4:12 pm
by radnet
It doesn't work like this. See e.g. this thread about similar problem.
Thank you for your replay, so we don't have any solution for this in mikrotik OS :(

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Fri Apr 28, 2017 5:25 pm
by pe1chl
This is not a matter of "no solution in RouterOS", what you want to do is simply impossible in networking!
You are trying to redirect a connection setup based on things you find in a running connection.
That requires "crystal ball" functionality.

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Sat Apr 29, 2017 12:35 pm
by radnet
This is not a matter of "no solution in RouterOS", what you want to do is simply impossible in networking!
You are trying to redirect a connection setup based on things you find in a running connection.
That requires "crystal ball" functionality.
Thank you pe1chl

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Sat May 27, 2017 5:45 pm
by horhay
Unless all you were really looking for was this.

https://wiki.mikrotik.com/wiki/Sync_Add ... _A_Records

Re: Connection Mark (or Packet Mark) Not Work In Firewall/NAT

Posted: Sat May 27, 2017 6:49 pm
by pe1chl
That is old and should probably be removed. Today, an address list can simply be set to a DNS name and it
will do what that script does. But, it is not at all related to the question asked in this topic...