RouterOS UDP 端口转发无法保留源 IP

This topic created in 501 days ago, the information mentioned may be changed or developed.

TCP 正常获取源 IP

UDP 获取到的是 RouterOS 的 IP

 8 ;;; Test chain=dstnat action=dst-nat to-addresses=192.168.1.52 protocol=udp dst-port=12345 log=no log-prefix="" 9 chain=dstnat action=dst-nat to-addresses=192.168.1.52 protocol=tcp dst-port=12345 log=no log-prefix=""

要如何配置才能正确 UDP 端口转发源 IP

Supplement 1 Jan 19, 2025

破案了是 FullCone 规则的问题，把 FullCone 规则放到映射的后面就行了

Supplement 2 Jan 19, 2025

更：需要在 FullCone 规则里设置 !Any port 不然还是无法获取源 IP

udp

源IP

6 replies 2025-01-20 09:48:33 +08:00

hefish

Jan 18, 2025

你这还有其他规则吧，要一并贴一下才行，就你贴的这两个规则，是没问题的。

ZRS

Jan 18, 2025

检查 masquerade 配置

577fkj

Jan 19, 2025

@hefish @ZRS
```
[admin@MikroTik] /ip/firewall/nat> print
Flags: X - disabled, I - invalid; D - dynamic
0 ;;; FullCone
chain=srcnat action=endpoint-independent-nat randomise-ports=no
protocol=udp log=no log-prefix=""

1 chain=dstnat action=endpoint-independent-nat randomise-ports=no
protocol=udp log=no log-prefix=""

2 ;;; Hairpin NAT
chain=srcnat action=masquerade src-address=192.168.1.0/24
dst-address=192.168.1.0/24 out-interface-list=LAN log=no log-prefix=""

3 ;;; defconf: masquerade IPv4
chain=srcnat action=masquerade out-interface-list=WAN log=no
log-prefix=""

4 ;;; onuconf: access to ONU
chain=srcnat action=masquerade src-address-list=local_lan_ipv4
dst-address-list=local_onu_ipv4 out-interface-list=ONU

5 ;;; Test
chain=dstnat action=dst-nat to-addresses=192.168.1.52 protocol=udp
dst-port=12345 log=no log-prefix=""

6 chain=dstnat action=dst-nat to-addresses=192.168.1.52 protocol=tcp
dst-port=12345 log=no log-prefix=""
```
还需要哪的配置吗

577fkj

Jan 19, 2025

@ZRS @hefish 问题已解决是 FullCone 规则的问题，放到端口映射后就正常了

sanquan

Jan 19, 2025 via iPhone

@577fkj fullclon 不应该在最前面吗

577fkj

Jan 20, 2025

@sanquan 后面我又试了下发现放在端口映射前后都一样，得在规则里添加忽略端口