Community discussions

MikroTik App
 
User avatar
hyp3R
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 50
Joined: Fri Oct 01, 2010 9:19 am
Location: Denmark, Copenhagen
Contact:

Nat translation

Thu Jan 27, 2011 1:54 pm

Hello there. Since I've red the manual and I couldn't figure it out.

Is it possible to have more than one public IP address for source NAT (PAT) translation on the same physical interface? I want to use pool of public IP addresses for masquerading internal privately addressed hosts.

Thanks in advance.
Alex
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7198
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: Nat translation

Thu Jan 27, 2011 3:10 pm

Yes, it is possible.
You can also use 1:1 mapping
http://wiki.mikrotik.com/wiki/Manual:IP ... :1_mapping
 
User avatar
hyp3R
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 50
Joined: Fri Oct 01, 2010 9:19 am
Location: Denmark, Copenhagen
Contact:

Re: Nat translation

Thu Jan 27, 2011 3:16 pm

Thank you, but can I use to-addresses parameter with source PAT ? I know about mapping but I need the thing written above.
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Nat translation

Thu Jan 27, 2011 4:03 pm

Yes.
/ip address 
add address=1.1.1.1 interface=wan
add address=1.1.1.2 interface=wan
/ip firewall nat
add chain=srcnat out-interface=wan src-address=192.168.1.0/25 action=src-nat to-address=1.1.1.1
add chain=srcnat out-interface=wan src-address=192.168.1.128/25 action=src-nat to-address=1.1.1.2
 
chadd
Member
Member
Posts: 348
Joined: Fri Dec 31, 2004 2:40 am

Re: Nat translation

Fri Jan 28, 2011 1:59 am

I have a question related to this, how would you go about doing say a 5-1 nat? For example you have a block of public IP's and you would like to NAT 5 private IP's to one Public? Is this something that could be done with address lists?
Yes.
/ip address 
add address=1.1.1.1 interface=wan
add address=1.1.1.2 interface=wan
/ip firewall nat
add chain=srcnat out-interface=wan src-address=192.168.1.0/25 action=src-nat to-address=1.1.1.1
add chain=srcnat out-interface=wan src-address=192.168.1.128/25 action=src-nat to-address=1.1.1.2
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Nat translation

Fri Jan 28, 2011 2:07 am

Yes, you could do that with address lists. They even take ranges. See below:
/ip firewall address-list
add list=pool1 address=192.168.0.2-192.168.0.6
add list=pool2 address=192.168.0.7-192.168.0.11
add list=pool3 address=192.168.0.12-192.168.0.16
add list=pool4 address=192.168.0.17-192.168.0.21
/ip address
add address=1.1.1.2 interface=WAN
add address=1.1.1.3 interface=WAN
add address=1.1.1.4 interface=WAN
add address=1.1.1.5 interface=WAN
/ip firewall nat
add chain=srcnat out-interface=WAN src-address-list=pool1 action=src-nat to-address=1.1.1.2
add chain=srcnat out-interface=WAN src-address-list=pool2 action=src-nat to-address=1.1.1.3
add chain=srcnat out-interface=WAN src-address-list=pool3 action=src-nat to-address=1.1.1.4
add chain=srcnat out-interface=WAN src-address-list=pool4 action=src-nat to-address=1.1.1.5
Another interesting approach - though I have never tried it - is to use PCC to balance clients across multiple addresses. The more clients, the more even the balance will be. You could pick other classifiers such as both-addresses-and-ports, but that would make secure sites rather unstable as they often rely on the client to come from the same source IP for the duration of a session:
/ip address
add address=1.1.1.2 interface=WAN
add address=1.1.1.3 interface=WAN
add address=1.1.1.4 interface=WAN
add address=1.1.1.5 interface=WAN
/ip firewall nat
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:0/4 action=src-nat to-address=1.1.1.2
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:1/4 action=src-nat to-address=1.1.1.3
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:2/4 action=src-nat to-address=1.1.1.4
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:3/4 action=src-nat to-address=1.1.1.5
add chain=srcnat out-interface=WAN action=src-nat to-address=1.1.1.1.2 comment="paranoid fallback"
 
chadd
Member
Member
Posts: 348
Joined: Fri Dec 31, 2004 2:40 am

Re: Nat translation

Fri Jan 28, 2011 2:43 am

Thanks for the Ideas..
Yes, you could do that with address lists. They even take ranges. See below:
/ip firewall address-list
add list=pool1 address=192.168.0.2-192.168.0.6
add list=pool2 address=192.168.0.7-192.168.0.11
add list=pool3 address=192.168.0.12-192.168.0.16
add list=pool4 address=192.168.0.17-192.168.0.21
/ip address
add address=1.1.1.2 interface=WAN
add address=1.1.1.3 interface=WAN
add address=1.1.1.4 interface=WAN
add address=1.1.1.5 interface=WAN
/ip firewall nat
add chain=srcnat out-interface=WAN src-address-list=pool1 action=src-nat to-address=1.1.1.2
add chain=srcnat out-interface=WAN src-address-list=pool2 action=src-nat to-address=1.1.1.3
add chain=srcnat out-interface=WAN src-address-list=pool3 action=src-nat to-address=1.1.1.4
add chain=srcnat out-interface=WAN src-address-list=pool4 action=src-nat to-address=1.1.1.5
Another interesting approach - though I have never tried it - is to use PCC to balance clients across multiple addresses. The more clients, the more even the balance will be. You could pick other classifiers such as both-addresses-and-ports, but that would make secure sites rather unstable as they often rely on the client to come from the same source IP for the duration of a session:
/ip address
add address=1.1.1.2 interface=WAN
add address=1.1.1.3 interface=WAN
add address=1.1.1.4 interface=WAN
add address=1.1.1.5 interface=WAN
/ip firewall nat
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:0/4 action=src-nat to-address=1.1.1.2
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:1/4 action=src-nat to-address=1.1.1.3
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:2/4 action=src-nat to-address=1.1.1.4
add chain=srcnat out-interface=WAN per-connection-classifier=src-address:3/4 action=src-nat to-address=1.1.1.5
add chain=srcnat out-interface=WAN action=src-nat to-address=1.1.1.1.2 comment="paranoid fallback"
 
User avatar
hyp3R
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 50
Joined: Fri Oct 01, 2010 9:19 am
Location: Denmark, Copenhagen
Contact:

Re: Nat translation

Fri Jan 28, 2011 1:07 pm

Hello everyone.
First off, thank you very much, What you have done for us is something priceless.

We have 13 zones (13 stations) on our network.
Translation was going only through one IP address. Up to 50k connection were open.
We didn't realize it can slow down internet so much. Our users didn't have enough bandwidth and internet was very slow.

Now we have added 13 addresses, each station has it's own address. It's working perfectly. This is just amazing!
Thanks so much!