Community discussions

MikroTik App
 
perinoid
just joined
Topic Author
Posts: 17
Joined: Mon Apr 02, 2012 1:18 pm

Akward forwarding - can I set it up somehow?

Thu Dec 06, 2012 2:20 pm

I have a RB 750 box, which works very well. Curently I have such setup:

internal network (host A and laptop B) <--------> RB750 <-----> Internet

I have a public address assigned (let's name it xxx.xxx.xxx.xxx), which is assigned to RB750. The internal network uses 10.0.0.0/24 adderess range, in particular, host A has address 10.0.0.3. I have also configured RB in such way, that host A is a DMZ - I want to get to it easily from the World. So far, everything works well.

I also have a laptop (B), which I use everywhere. Whenever I'm outside my office, I can easily get to host A by connecting to xxx.xxx.xxx.xxx address and RB does connection forwarding as a charm. But when I am at work, I'm in the internal network. If I want to connect to host A using the same xxx.xxx.xxx.xxx address, it does not work. Using xxx.xxx.xxx.xxx connects me with RB, not host A - DMZ is set to work only from the external network, not the internal one. In order to do connect to host A I must use its internal address 10.0.0.3. Sometimes it is not a big problem, but I have to remember that and have 2 sets of scripts prepared.

Is it possible to configure forwarding in such way, that no matter from which network I'm trying to connect to the address xxx.xxx.xxx.xxx, my RB750 always redirects me to host A? Of course, this forwarding must not work for address 10.0.0.1, which is the RB750 address in my local network. I have tried to create some additional forwarding rules (using WWW UI, I'm not familiar with command line configuration in RouterOS), but it didn't work.

PS. I know, that data transfers with such forwarding may be slower, when compared to direct communication in the local network, but it is not the point here.
 
CelticComms
Forum Guru
Forum Guru
Posts: 1765
Joined: Wed May 02, 2012 5:48 am

Re: Akward forwarding - can I set it up somehow?

Thu Dec 06, 2012 2:27 pm

 
perinoid
just joined
Topic Author
Posts: 17
Joined: Mon Apr 02, 2012 1:18 pm

Re: Akward forwarding - can I set it up somehow?

Thu Dec 06, 2012 4:06 pm

Thanks for your response. Initially, my NAT+DMZ was configured in such way:
[admin@geralt] /ip firewall nat> /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
     chain=srcnat action=masquerade to-addresses=0.0.0.0 out-interface=ether1-gateway 

 1   chain=dstnat action=dst-nat to-addresses=10.0.0.3 dst-address=xxx.xxx.xxx.xxx in-interface=ether1-gateway 
I don't want to forward particular ports, just the whole machine must be visible. As I presume, in my case the additional rule would have to look like this:
/ip firewall nat add chain=srcnat src-address=10.0.0.0/24 dst-address=10.0.0.3 out-interface=LAN action=masquerade
But it still is not working. I had to exclude in-interface from rule 1 and now it is working:
[admin@geralt] /ip firewall nat> /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
     chain=srcnat action=masquerade to-addresses=0.0.0.0 out-interface=ether1-gateway 

 1   chain=dstnat action=dst-nat to-addresses=10.0.0.3 dst-address=xxx.xxx.xxx.xxx 

 2   chain=srcnat action=masquerade src-address=10.0.0.0/24 dst-address=10.0.0.3 out-interface=ether2-local-master 
Thanks for help.