Some protocols need more than one TCP or UDP connection. For NAT to work the firewall needs to open additional ports to allow client server connection automatically. Examples are FTP (port 21 handshake, additional ports for data), PPTP (port 1723 for handshake, proto GRE 47 for payload)
Since Linux kernel (~) 4.7 these helpers are not bound automatically to iptables for security reasons. The idea is to implement iptables rules to activate connection helpers explicitly. Just loading the helper module is not enough.
To change this to the old behavior you can add this to your startup (for example /etc/rc.local)
# echo 1 > proc/sys/net/netfilter/nf_conntrack_helper
Discussion: Every routing protocol has a default distance to help the router to decide which route to use in case of multiple routes for the same destination. For Mikrotik routers these distances are listed here:
If you want to configure a backup link that is only activated when the OSPF main route is missing, you can use a static route with distance 120 which is higher than the OSPF default 110.
If you enter this route in a mikrotik after the ospf route is learned it works as expected. The static 120 route is ignored until the ospf route vanishes.
But the other way arround does not work. If the 120 route is active, the OSPF route is ignored even it has the better distance of 110. And worse the Mikrotik keeps this route in its own OSPF announcement.
This is a known bug: https://forum.mikrotik.com/viewtopic.php?t=119493
Work around: You can make two smaller routes for the preferred path.
eg. two /26 should always overrule a /25 route.
Version: Mikrotik RouterOS 6.46.1