Port-forwarding with mwan3 not working for one wan

Installing and Using OpenWrt
1

Hello.

I have a turris router with two internet links connected to it (say wanA and wanB), and I am using mwan3 for load balancing those two links.

I have a few servers behind this router which I am using port-forwarding. So far all my servers are being accessed via wanA.
I was trying to setup port-forwarding to a new server so that incoming connections from wanB would be routed to this server.

I used luci to setup the port-forwarding, but I can't make it work.

I was using tcpdump/wireshark to find out if the incoming connections were reaching my server, behind the router, and indeed it is.
So I believe the replies to these incoming connections are going to lalaland instead of back to the client. For context, it is a webserver, but any other service is facing the same issue

I can see the incoming SYN connections, and my server replying the SYN/ACK, but seems like the router isn't properly sending the packets back to the client.
I'm guessing it's something related to the routing, but I'm not sure how to fix it.
Could somebody help me debug it?
Thanks

2

Please post output of

ubus call system board

Check conntrack -E whether translation applies
Or trace nftables (change port obviously)

3 
# ubus call system board
{
	"kernel": "5.15.148",
	"hostname": "turris",
	"system": "ARMv7 Processor rev 1 (v7l)",
	"model": "Turris Omnia",
	"board_name": "cznic,turris-omnia",
	"rootfs_type": "btrfs",
	"release": {
		"distribution": "TurrisOS",
		"version": "7.1.4",
		"revision": "r20343+130-4e1d1b7df0",
		"target": "mvebu/cortexa9",
		"description": "TurrisOS 7.1.4 4e1d1b7df0ce6fa96d7462dc883917682f428046"
	}
}
4

What I can see on the conntrack -E output is essentially, for obvious reasons I trimmed the IP public addresses :
...186 is the client I'm using to test
...158.184 is my router's WAN
10.0.0.99 is my server behind the router.

    [NEW] tcp      6 120 SYN_SENT src=...186 dst=.158.184 sport=15500 dport=80 [UNREPLIED] src=10.10.0.99 dst=....112.186 sport=80 dport=15500 mark=256
 [UPDATE] tcp      6 60 SYN_RECV src=....186 dst=....158.184 sport=15489 dport=80 src=10.10.0.99 dst=.....186 sport=80 dport=15489 mark=256
 [UPDATE] tcp      6 60 SYN_RECV src=....186 dst=....158.184 sport=15500 dport=80 src=10.10.0.99 dst=....186 sport=80 dport=15500 mark=256

I can see the connection requests, but I'm not sure how to interrpet it

5

I've fixed it, so, just leaving the solution here in case somebody steps on it in the future.

My configuration was missing a policy/rule pair in my mwan3 configuration to allow traffic from my internal server to be routed back to a specific wan, instead of the default gateway, detailed steps on how to configure it are here:

https://openwrt.org/docs/guide-user/network/wan/multiwan/mwan3#controlling_the_mapping_between_internal_ip_sources_and_external_ips_and_interfaces