Hi,
Here is the situation; I have an eoip tunnel from main router to a remote router somewhere else in the building. Over this tunnel I have established a pppoe link. It all works up to a point, where I need to set a NAT masquerade rule for pppoe tunnel. Before 6.20.1 I could do this without a problem, with 6.20.1 it gives me error: --- in/out interface matcher not possible when interface [pppoe-xxx-xxx] is slave - use master instead [eoip-xxx-xxx].
The rule is RED as invalid.
Any clues?
Re: NAT Masquerade problem in 6.20.1
Show the configs of the interfaces on both sides and the NAT rule. A schematic, including IP addressing, would be very helpful. It's difficult to help you, when you don't even say what you want to NAT.
Re: NAT Masquerade problem in 6.20.1
The eoip and pppoe links are working as expected, the problem is only in NAT rule, so you shouldn't need any other config then what I pasted below:Show the configs of the interfaces on both sides and the NAT rule. A schematic, including IP addressing, would be very helpful. It's difficult to help you, when you don't even say what you want to NAT.
Code: Select all
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=pppoe-adsl log=no
log-prefix=""
Re: NAT Masquerade problem in 6.20.1
I just upgraded and also ran into the same error. Perhaps my resolution will assist you in finding yours.
In my case, I have an EoIP tunnel (running over VPN) from an external MT that was *Bridged* locally to an ethernet port. I was doing NAT and firewall filtering on traffic arriving from or departing to the remote network, so the rules were pointing to an in-interface or out-interface of the EoIP interface directly. After the ROS upgrade I had to change the rules to alleviate the error you have indicated, eliminating the in-interface or out-interface value, and instead using the in-bridge-port or out-bridge-port variable to point to my same EoIP interface. Note, this also requires enabling the use of IP firewall in Bridge settings.
In my case, I have an EoIP tunnel (running over VPN) from an external MT that was *Bridged* locally to an ethernet port. I was doing NAT and firewall filtering on traffic arriving from or departing to the remote network, so the rules were pointing to an in-interface or out-interface of the EoIP interface directly. After the ROS upgrade I had to change the rules to alleviate the error you have indicated, eliminating the in-interface or out-interface value, and instead using the in-bridge-port or out-bridge-port variable to point to my same EoIP interface. Note, this also requires enabling the use of IP firewall in Bridge settings.
Re: NAT Masquerade problem in 6.20.1
Thank you for your answer. in my case a reboot helped...I just upgraded and also ran into the same error. Perhaps my resolution will assist you in finding yours.
In my case, I have an EoIP tunnel (running over VPN) from an external MT that was *Bridged* locally to an ethernet port. I was doing NAT and firewall filtering on traffic arriving from or departing to the remote network, so the rules were pointing to an in-interface or out-interface of the EoIP interface directly. After the ROS upgrade I had to change the rules to alleviate the error you have indicated, eliminating the in-interface or out-interface value, and instead using the in-bridge-port or out-bridge-port variable to point to my same EoIP interface. Note, this also requires enabling the use of IP firewall in Bridge settings.