Code: Select all
/ip firewall nat> add chain=jpne-nat action=masquerade to-ports=64624-64639 protocol=icmp out-interface=sonet-jpne
failure: to-ports valid only for tcp/udp/sctp/dccp
Some quick context: My internet connection is delivered as native ipv6, with ipv4 tunneled via MAP-E (RFC7597). I share a single ipv4 address with 256 other customers, where the middle 8 bits of the port identify the customer. I can get functioning UDP and TCP by defining a sequence of rules with the nth matcher that load balances across my 16 port-sets. Concretely this looks like
Code: Select all
...
chain=jpne-nat action=masquerade to-ports=56432-56447 protocol=tcp out-interface=sonet-jpne nth=3,1
chain=jpne-nat action=masquerade to-ports=56432-56447 protocol=udp out-interface=sonet-jpne nth=3,1
chain=jpne-nat action=masquerade to-ports=60528-60543 protocol=tcp out-interface=sonet-jpne nth=2,1
chain=jpne-nat action=masquerade to-ports=60528-60543 protocol=udp out-interface=sonet-jpne nth=2,1
chain=jpne-nat action=masquerade to-ports=64624-64639 protocol=tcp out-interface=sonet-jpne
chain=jpne-nat action=masquerade to-ports=64624-64639 protocol=udp out-interface=sonet-jpne
It would be nice to have ICMP echo requests as well. iptables has supported masquerading icmp with to-ports since 2005 https://git.netfilter.org/iptables/comm ... 5e0fb0a0ab. Could the routeros restriction be modified to match?
