Community discussions

MikroTik App
 
nicopretorius
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 77
Joined: Mon Nov 15, 2004 9:49 am

dst-nat to remote server

Mon Feb 13, 2012 11:20 pm

I need to forward RADIUS traffic from an external WLAN controller (customer's network with no routing to my priavte network) to my RADIUS server which is on a private routed network i.e. the WLAN controller does not have any routing to my RADIUS server and vice versa. The RADIUS server (10.0.50.30) communicates to my customer router via a private PPTP tunnel. The WLAN Controller send 802.1x traffic to ---> 192.168.0.9 (RB1 - Customer router) and I need this traffic to reach my RADIUS server.

I want to forward the 802.1x traffic from the WLAN controller to my RADIUS server which connects to the Customer router via a PPTP tunnel as per the below.
802.1x <---> (External IP: 192.168.0.9) RB1 (Internal IP: 10.0.0.226) <---PPtP---> (10.0.0.1) RB2 (10.0.50.1)<---> RADIUS Server (10.0.50.30)

I have configured the following dst-nat on RB1, but I don't think this will work as my understanding is that dst-nat can only be applied to local addresses, i.e. RB1 will not forward the traffic to RB2 via the PPTP tunnel.
/ip firewall nat
add action=dst-nat chain=dstnat comment="Forward 802.1x traffic to 10.0.50.30" disabled=no dst-address=192.168.0.9 dst-port=\
    1812 in-interface=internet protocol=udp to-addresses=10.0.50.30 to-ports=1812
add action=dst-nat chain=dstnat comment="Forward 802.1x traffic to 10.0.50.30" disabled=no dst-address=192.168.0.9 dst-port=\
    1813 in-interface=internet protocol=udp to-addresses=10.0.50.30 to-ports=1813
Will the above work or am I correct that dst-nat can only be applied for local addresses? If dst-nat can only be used locally, how do I get RB1 to NAT and forward this traffic to RB2. Do I use the netmap function instead?

Thanks,

Nico
 
nicopretorius
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 77
Joined: Mon Nov 15, 2004 9:49 am

Re: dst-nat to remote server

Tue Feb 14, 2012 10:14 am

To answer my own question. It is as straight forward as configuring the dst-nat. The to-addresses does not have to be locally connected to the router on one of its physical interfaces.

Who is online

Users browsing this forum: Ahrefs [Bot], Bing [Bot], Google [Bot], muztahidultanim, ursaca and 53 guests