Firewall problem on 378.56_2?

[BugsXor]

Hi,

This is really a twofold question.
1) Has something changed with the firewall rules from 378.56_2 when doing NATTING from WAN?
2) How do I see the firewall rules?

a bit more details:
It starts with the traditional sentence: "Everything was working fine, I didn't change anything... then something broke!"
Basically... I used to be able to SSH back home from the internet -> a Mikrotik router -> ASUS AC87U -> My server
Then suddenly, it stopped working...
After troubleshooting I noticed that if I have the ASUS AC87U firewall "On" it doesn't work.
If I turn it off... it works!
But I would prefer to keep it it on... even if my ASUS is on my internal network.
I have the following settings when turned "ON":
Enable Firewall -> On
Enable DOS protection -> Off
Logged packet -> Both
Respond ping from WAN -> Yes
NAT Loopback -> Merlin

My Asus is in Wireless Router Mode
For the WAN internet connection config I disabled NAT
(I need the NAT disabled to see traffic IP source on my IDS... I used a passive tap to Tee the traffic.).

When it doesn't work (with firewall on the ASUS ON) I don't see any logged traffic (i.e.: drop)

How could I troubleshoot the issue? and find out what rules on the ASUS firewall drops my Natted traffic from outside -> mikrotik -> Asus -> server ?
I don't seem to see any rules on the ASUS GUI.

Thanks for your help.
B.

 

[BugsXor]

Hum... people seem to have issues with NAT...
The above issue is also realted to NAT but get "fixed" when turning off the Firewall...
Same issue?

http://www.snbforums.com/threads/merlin-nat-loopback-problem.29959/

 

[Martineau]

Hi,

This is really a twofold question.
1) Has something changed with the firewall rules from 378.56_2 when doing NATTING from WAN?
2) How do I see the firewall rules?

A.1 Maybe?
A2.

iptables   -L  -xvn   --line
iptables   -L  -xnv   --line   -t   mangle
iptables   -L  -xvn   --line   -t   nat

 

[BugsXor]

A.1 Maybe?
A2.

iptables   -L  -xvn   --line
iptables   -L  -xnv   --line   -t   mangle
iptables   -L  -xvn   --line   -t   nat

Thanks for that! very useful
I couldn't see anything wrong with the output... I am fairly sure something has changed in the last few Merlin Firmware with NAT.
Will have to experiment a bit more!