When a host on an internal network accesses an external web page through a MikroTik router doing source NAT, which chain do the packets flow through?

When a host on an internal network accesses an external web page through a MikroTik router using source NAT, the packets flow through the forward chain. This is because source NAT is configured to modify packets that are being routed from an internal network to an external network.

In this scenario, the packets originate from the internal host and are destined for an external web server. Therefore, the MikroTik router processes these packets in the forward chain, which is specifically designed to handle packets that are passing through the router from one interface to another, not destined for the router itself. The forward chain is invoked for traffic that is internally routed out to the internet, enabling NAT rules to translate the source IP address of the internal host to the public IP address of the router as the packets leave.

This understanding helps clarify how network address translation functions in a routing environment and illustrates the responsibilities of each chain within MikroTik’s firewall framework.