Sunday, 15 Apr, 2018  |    3 Comments

mikrotik-logo

mikrotik-logo

This is a straight hands-on post.

Example of 1:1 Public-to-Private IP mapping.

/ip firewall nat add chain=dstnat dst-address=<Public IP> action=netmap to-addresses=<Private IP>
/ip firewall nat add chain=srcnat src-address=<Private IP> action=netmap to-addresses=<Public IP>

Source NAT.

Used to “hide” the private source IP Address (i.e.:192.168.1.109), aka masquerading.

To use masquerading, a source NAT rule with action 'masquerade' should be added to the firewall configuration:

/ip firewall nat add chain=srcnat action=masquerade out-interface=Public

Above example shows you how to configure NAT on a Mikrotik router.

 

Destination NAT.

Destination NAT is used to “link” the Public IP Address (say 10.5.8.200) to the Local IP Address of your liking (say 192.168.0.109).

This is done to allow the Local IP Address to talk to the Public IP Address.

Please note - for that to work, you should also use Source Network Address translation (please ref. to above).

Working Example:

  • Add a Public IP Address to your "Public" interface:

/ip address add address=10.5.8.200/32 interface=Public

Add a rule that allows access to the Internal Server from the External Networks:

/ip firewall nat add chain=dstnat dst-address=10.5.8.200 action=dst-nat to-addresses=192.168.0.109

Adds a rule that allows the Internal Server to talk to the Outer Networks (ie. by having its source IP Address translated to 10.5.8.200):

/ip firewall nat add chain=srcnat src-address=192.168.0.109 action=src-nat to-addresses=10.5.8.200

Example of 1:1 Subnet Mapping.

If you want to link a WHOLE Public IP Subnet (say 11.11.11.0/24) to a Local Private IP Subnet (say to 10.10.10.0/24), you should use Destination address translation and Source address translation With the "action=netmap".

/ip firewall nat add chain=dstnat dst-address=11.11.11.1-11.11.11.254 action=netmap to-addresses=10.10.10.1-10.10.10.254
/ip firewall nat add chain=srcnat src-address=10.10.10.1-10.10.10..254 action=netmap to-addresses=11.11.11.1-11.11.11.254

SRC:

http://www.mikrotik.com/testdocs/ros/2.9/ip/nat.php

ASHISH PATEL: http://forum.mikrotik.com/viewtopic.php?f=2&t=22123

3.2/5 - (67 votes)

3 comments on “Mikrotik 1-to-1 NAT with netmap and masquerade.”

  • hello andrea,
    how can i make clients within the same sunet i.e 192.168.1.105 and 192.168.1.106 to be able to ping each other.

    • 1/ make sure windows firewalls doesn´t block icmp
      2/ make sure that icmp packets are allowed in MikroTik forward chain
      3/ if you need to ping hostnames, than you need DNS entries or at least netbios funkcionality like wins in windows world

  • Hi Thanks for the info. Also, if i just want to add another subnet to a system, do i just do an add ip and then winbox do the correct route ? And to talk each other, i guess same gateway will be on both. Like mikrotik router: 192.168.88.1 and new subnet : 192.168.5.1. So the pc using the ...5.1 will need the gateway : ..88.1. and then ping all the ..88. sub. ?
    Thanks

Comments are closed.