Hello,

I am trying to configure one of my clients with a public IP that is reachable from the web. He is at a remote site on the LAN side of my Mikrotik router. He has a private ip currently. I have tried so many different NAT rules to accomplish this. I have is router bound to a private IP in the leases section by MAC.

this one allows him to appear public to the web from the private IP but it only works outgoing. Incoming traffic to the public ip still does not reach him. I could use some direction here please.

/ip firewall nat
add action=dst-nat chain=dstnat comment="test" disabled=no dst-address=<public IP> to-addresses=<private IP>
add action=src-nat chain=srcnat comment="test" disabled=no src-address=<private IP> to-addresses=<public IP>

Does this dstnat rule have any hits? If not, there's some other dstnat rule before it that catches those packets first. If yes, it might be blocked by some rule in /ip firewall filter, forward chain.

Yes. 562.2KiB.

Hello,

I am trying to configure one of my clients with a public IP that is reachable from the web. He is at a remote site on the LAN side of my Mikrotik router. He has a private ip currently. I have tried so many different NAT rules to accomplish this. I have is router bound to a private IP in the leases section by MAC.

this one allows him to appear public to the web from the private IP but it only works outgoing. Incoming traffic to the public ip still does not reach him. I could use some direction here please.

/ip firewall nat
add action=dst-nat chain=dstnat comment="test" disabled=no dst-address=<public IP> to-addresses=<private IP>
add action=src-nat chain=srcnat comment="test" disabled=no src-address=<private IP> to-addresses=<public IP>

You can always route the IP to him rather than use NAT if he is at a remote location that is routable. It doesn't matter if the IP addressing is private.

Also make sure that you have a filter allowing forward traffic to your client.

Sent from Tapatalk

You can bridge the public IP to him with EoIP if it is part of a subnet somewhere else. Alternatively, build a tunnel with a technology like GRE to the customer network and route the IP down to them.