Community discussions

MikroTik App
 
vSoul
just joined
Topic Author
Posts: 6
Joined: Thu May 05, 2011 3:31 pm

Destination NAT with the replacement of IP source address

Thu May 05, 2011 4:43 pm

Hello, there is one problem that I could not solve.
How can I configure the following:
Destination NAT with the replacement of IP source address, like Microsoft ISA/TMG Server ('Requests appear to come from the ISA Server' option)

Packet flow:

ExtIPc______ExtIPr_IntIPr____IntIPs
Client ------1-> Router-----2->Server
<-3-----------

Packet, stage 1:
Source IP: External Client IP (ExtIPc)
Destination: External Router IP (ExtIPr)

Packet, stage 2:
Source IP: Internal Router IP (IntIPr)
Destination: Internal Server IP (IntIPs)

Packet, stage 3:
Source IP: External Router IP (ExtIPr)
Destination: External Client IP (ExtIPc)

Thanks.
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Destination NAT with the replacement of IP source addres

Thu May 05, 2011 5:09 pm

Configure both source and destination NAT rules. Destination NAT translates the destination IP address in the packet header of the first packet of a connection, repeats the same operation for all subsequent packets, and does the reverse for return traffic. Source NAT translates the source IP address in the packet header of the first packet of a connection, repeats the same operation for all subsequent packets, and does the return traffic. Source NAT happens after destination NAT, so when source NAT looks at the packet the destination IP has already been rewritten.

Consule the packet flow manual page for details: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

For example, let's assume host 1.1.1.1 sends a packet to 2.2.2.2. You want the packet to go 3.3.3.3 instead, and to appear to be coming from 4.4.4.4.
/ip firewall nat
add chain=dstnat src-address=1.1.1.1 dst-address=2.2.2.2 action=dst-nat to-address=3.3.3.3
add chain=srcnat src-address=1.1.1.1 dst-address=3.3.3.3 action=src-nat to-address=4.4.4.4
1. 1.1.1.1 sends to 2.2.2.2
2. after the packet has traversed the destination NAT chain 1.1.1.1 sends to 3.3.3.3
3. after the packet has traversed the source NAT chain 4.4.4.4 sends to 3.3.3.3
4. 3.3.3.3 processes the packet and sends back to 4.4.4.4
5. after the packet has traversed the destination NAT chain to undo the source NAT that happened the other way 3.3.3.3 sends to 1.1.1.1
6. after the packet has traversed the source NAT chain to undo the destination NAT that happened the other way 2.2.2.2 sends to 1.1.1.1
 
vSoul
just joined
Topic Author
Posts: 6
Joined: Thu May 05, 2011 3:31 pm

Re: Destination NAT with the replacement of IP source addres

Thu May 05, 2011 10:50 pm

It works. Thank you.
 
zali126
just joined
Posts: 1
Joined: Tue Dec 12, 2017 2:11 pm

Re: Destination NAT with the replacement of IP source address

Tue Dec 12, 2017 2:45 pm

Can reply with diagram i have Mikrotik Barodband Router
Hello, there is one problem that I could not solve.
How can I configure the following:
Destination NAT with the replacement of IP source address, like Microsoft ISA/TMG Server ('Requests appear to come from the ISA Server' option)

Packet flow:

ExtIPc______ExtIPr_IntIPr____IntIPs
Client ------1-> Router-----2->Server
<-3-----------

Packet, stage 1:
Source IP: External Client IP (ExtIPc)
Destination: External Router IP (ExtIPr)

Packet, stage 2:
Source IP: Internal Router IP (IntIPr)
Destination: Internal Server IP (IntIPs)

Packet, stage 3:
Source IP: External Router IP (ExtIPr)
Destination: External Client IP (ExtIPc)

Thanks.
 
vercebe
just joined
Posts: 3
Joined: Sat Mar 03, 2018 7:40 pm

Re: Destination NAT with the replacement of IP source addres

Thu Mar 15, 2018 2:00 am

Configure both source and destination NAT rules. Destination NAT translates the destination IP address in the packet header of the first packet of a connection, repeats the same operation for all subsequent packets, and does the reverse for return traffic. Source NAT translates the source IP address in the packet header of the first packet of a connection, repeats the same operation for all subsequent packets, and does the return traffic. Source NAT happens after destination NAT, so when source NAT looks at the packet the destination IP has already been rewritten.

Consule the packet flow manual page for details: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

For example, let's assume host 1.1.1.1 sends a packet to 2.2.2.2. You want the packet to go 3.3.3.3 instead, and to appear to be coming from 4.4.4.4.
/ip firewall nat
add chain=dstnat src-address=1.1.1.1 dst-address=2.2.2.2 action=dst-nat to-address=3.3.3.3
add chain=srcnat src-address=1.1.1.1 dst-address=3.3.3.3 action=src-nat to-address=4.4.4.4
1. 1.1.1.1 sends to 2.2.2.2
2. after the packet has traversed the destination NAT chain 1.1.1.1 sends to 3.3.3.3
3. after the packet has traversed the source NAT chain 4.4.4.4 sends to 3.3.3.3
4. 3.3.3.3 processes the packet and sends back to 4.4.4.4
5. after the packet has traversed the destination NAT chain to undo the source NAT that happened the other way 3.3.3.3 sends to 1.1.1.1
6. after the packet has traversed the source NAT chain to undo the destination NAT that happened the other way 2.2.2.2 sends to 1.1.1.1
Hi Fewi, I find your post very useful. I am available to send packets to monitor them. If possible to receive them whit their originally source ip. I am using wireshark. Thank you.
 
solar77
Long time Member
Long time Member
Posts: 586
Joined: Thu Feb 04, 2016 11:42 am
Location: Scotland

Re: Destination NAT with the replacement of IP source address

Fri Mar 16, 2018 1:24 pm

Hi fewi, great stuff, very useful!

Who is online

Users browsing this forum: A9691, Amazon [Bot], Google [Bot], GoogleOther [Bot], GuJack20, hatred, korg, mojojojo and 61 guests