This may be a dumb question but I recently replaced a router on a customers network with a MT router. After doing this and setting up all of the NAT's to their web servers as DST-NAT's, their log files on their web server show all connections coming from the IP of the router instead of the external IP addresses of Internet users. Is it possible for MT to pass along the actual IP of the customer like other NAT routers do?
Thanks,
Brad
As long as I was using this configuration ...
port forward helps you to open up a port in your router or firewall so that you can access your application safely but If you want to access your web server , users can not reach the ip of web server , they'll still see it as ip of router that is because we use or call it as webserver behind a firewall .
I use this configuration to protect my webserver which i give one public ip on Mikrotik Rourters then my webserver could be natted
.
port forward helps you to open up a port in your router or firewall so that you can access your application safely but If you want to access your web server , users can not reach the ip of web server , they'll still see it as ip of router that is because we use or call it as webserver behind a firewall .
I use this configuration to protect my webserver which i give one public ip on Mikrotik Rourters then my webserver could be natted
.I have assigned the IP of "71.153.22.22" to the router, then I am doing a DST-NAT to the internal IP of the server "10.1.2.20" but in the logs on the webserver, it always lists every hit as coming from "71.153.22.23" which is an IP on the MT router that is not being used in a NAT.
add chain=dstnat dst-address=71.153.22.22 protocol=tcp dst-port=80 action=dst-nat to-addresses=10.1.2.20 to-ports=80
add chain=dstnat dst-address=71.153.22.22 protocol=tcp dst-port=80 action=dst-nat to-addresses=10.1.2.20 to-ports=80
Re: External IP address replaced with router
If I understand correctly, you have set the SRC-NAT rule with out-interface=all. This will also masquerade connections from outside->in. change the out-interface settingThis may be a dumb question but I recently replaced a router on a customers network with a MT router. After doing this and setting up all of the NAT's to their web servers as DST-NAT's, their log files on their web server show all connections coming from the IP of the router instead of the external IP addresses of Internet users. Is it possible for MT to pass along the actual IP of the customer like other NAT routers do?
Thanks,
Brad
Re: External IP address replaced with router
If I understand correctly, you have set the SRC-NAT rule with out-interface=all. This will also masquerade connections from outside->in. change the out-interface settingThis may be a dumb question but I recently replaced a router on a customers network with a MT router. After doing this and setting up all of the NAT's to their web servers as DST-NAT's, their log files on their web server show all connections coming from the IP of the router instead of the external IP addresses of Internet users. Is it possible for MT to pass along the actual IP of the customer like other NAT routers do?
Thanks,
Brad
yes it seems that this rule is taken everything out .. I always strict my rule using in-interface or out-interface so I can manage my network .
I set the out-interface=(outside interface) and now when I connect to the web server from the Internet, it is showing the correct IP in the logs so that resolved it. But now the problem I have is users internally can no longer get to the website by using the DNS name which points to the external IP. What would I need to change to resolve that?
You could redirect the internal requests like this (command from memory, check for typos!):
where:
1.2.3.4 is the public ip address of your webserver
192.168.0.0/24 is your internal ip address range
192.168.0.100 is the internal ip address of your webserver
ether2 is the interface name of your internal network interface
This should allow access to your internal webserver from the internal LAN using the public ip address of the webserver.
Best regards,
Christian Meis
Code: Select all
/ip firewall nat add chain=dstnat in-interface=ether2 protocol=tcp dst-port=80 dst-address=1.2.3.4 action=dst-nat to-addresses=192.168.0.100
/ip firewall nat add chain=srcnat out-interface=ether2 src-address=192.168.0.0/24 dst-address=192.168.0.100 action=masquerade1.2.3.4 is the public ip address of your webserver
192.168.0.0/24 is your internal ip address range
192.168.0.100 is the internal ip address of your webserver
ether2 is the interface name of your internal network interface
This should allow access to your internal webserver from the internal LAN using the public ip address of the webserver.
Best regards,
Christian Meis