Setup guide
The TOS can be one of five types, each of them is an instruction to:
• low-cost - minimize monetary cost
• low-delay - minimize delay
• normal - normal service
• max-reliability - maximize reliability
• max-throughput - maximize throughput
Common NAT Parameters
Description
The src-nat and the dst-nat have some common properties listed below. In turn, properties specific
to each type of NAT will be listed in appropriate sections.
Property Description
dst-address (IP address; default: 0.0.0.0/0:0-65535) - destination IP address
src-address (IP address; default: 0.0.0.0/0:0-65535) - source IP address
flow - flow mark to match. Only packets marked in the mangle facility would be matched
limit-time (time; default: 0) - time interval, used in limit-count
protocol (ah | all | ddp | egp | encap | esp | ggp | gre | hmp | icmp | idpr-cmtp | igmp | ipencap | ipip |
iso-tp4 | ospf | pup | rdp | rspf | st | tcp | udp | vmtp | xns-idp | xtp; default: any) - protocol setting
• all - cannot be used, if you want to match packets by ports
icmp-options - ICMP options
content (text; default: "") - the text packets should contain in order to match the rule
comment (text; default: "") - a descriptive comment for the rule
connection (text; default: "") - connection mark to match. Only packets marked in the mangle
facility would be matched
limit-burst (integer; default: 0) - allowed burst for the limit-count during the limit-time
limit-count (integer; default: 0) - specifies how many times to use the rule during the limit-time
period
src-netmask (IP address) - source netmask in decimal form x.x.x.x
src-port (integer: 0..65535) - source port number or range
• 0 - means all ports from 0 to 65535
dst-netmask (IP address) - destination netmask in decimal form x.x.x.x
dst-port (integer: 0..65535) - destination port number or range
• 0 - means all ports from 0 to 65535
tos (any | max-reliability | max-throughput | min-cost | min-delay | normal | integer; default: any) -
specifies a match for Type-of-Service field of an IP packet
Notes
The Connection Tracking facility (/ip firewall connection tracking) must be enabled if you want
to use NAT.