/ip firewall nat
add action=src-nat chain=srcnat src-address=10.1.86.50 to-addresses=xxx.xxx.xxx.xxx
add action=dst-nat chain=dstnat dst-address=xxx.xxx.xxx.xxx to-addresses=10.1.86.50
add action=masquerade chain=srcnat
Basic Solution:I have had him even hook xbox and bypass his router and sometimes it works and sometimes it doesn't.Code: Select all/ip firewall nat add action=src-nat chain=srcnat src-address=10.1.86.50 to-addresses=xxx.xxx.xxx.xxx add action=dst-nat chain=dstnat dst-address=xxx.xxx.xxx.xxx to-addresses=10.1.86.50 add action=masquerade chain=srcnat
Any Suggestions would be appreciated.
Clarification on this. So the location this is at has 212 vlans with private address on each vlan. Is there a simple masquerade rule for this?
Basic Solution:
Does the masquerade action have a match criteria that limits it to packets going out the WAN interface?
If not, then it seems that new connections from the Internet to the user's public IP would get masqueraded to appear as if they are from the Mikrotik's internal IP address. Most users don't see this because reply packets on existing sockets don't go through the chains, state tracking maps them back automatically.
Remember that packets will go through both the source and destination NAT chains.
Specific nat rules for specific customers with specific public IP mappings come first.Clarification on this. So the location this is at has 212 vlans with private address on each vlan. Is there a simple masquerade rule for this?
action=masquerade chain=srcnat src-address=10.0.0.0/8
Or would I need to create a masquerade rule for each vlan?
action=masquerade chain=srcnat src-address=10.1.2.0/24
Thanks
/ip firewall add chain=srcnat action=masquerade out-interface=wan
/ip firewall filter
add chain=forward action=accept connection-state=established
add chain=forward action=accept connection-state=related
add chain=forward action=accept out-interface=wan
add chain=forward action=drop
Just incase I have to go this way the rules I assume would beMacGuyver solution:
If making the masquerade rule more strict doesn't fix things, then you could always try to forward it directly to them in stead:
- Change the dstnat/srcnat rules:
-- src-address=xxx.xxx.xxx.xxx action = accept (pass the public IP through w/o NAT)
-- dst-address=xxx.xxx.xxx.xxx action = accept (ditto)
- Static route xxx.xxx.xxx.xxx/32 next-hop = LanInterfaceName
WAN interface, set arp=proxy-arp
LAN interface, set arp=proxy-arp
After doing all of that, the user can actually put their static IP address directly on their equipment, and you won't be doing any NAT for them. They should set their netmask / default GW to be the same as the Mikrotik uses.
If you want to keep other users from stealing their public IP, you can add a static ARP entry with the correct users' MAC address.
Yes, the public IP you want to assign to the customer.Just incase I have to go this way the rules I assume would be
/ip firewall nat
add action=dst-nat dst-address=xxx.xxx.xxx.xxx action=accept
add action=src-nat src-address=xxx.xxx.xxx.xxx action=accept (this should be public ip correct?)
the route I am not sure how to setup.
The interfaces I already have set for proxy-arp
According to the fiirst part of the discussion on this link:In the past this has worked fine. I now have a tenant who is trying to setup his xbox one behind a router and he is complaining about a strict nat type with the above setup.