1-to-1 NAT problems at Internet Gateway

RouterOS Beginner Basics
1

I am having problems with my NAT rules at our internet gateway. Everything works properly for our 1-to-1 NAT except if you try to get to one of the 1-to-1 NAT’d addresses from inside the network. I assume that there’s something wrong with my DST-NAT or SRC-NAT Rules.

Here’s an example:

add action=dst-nat chain=dstnat comment=“xxxxx” disabled=no dst-address=
69.x.x.161 to-addresses=10.x.x.12
add action=src-nat chain=srcnat comment=“xxxxx” disabled=no
out-interface=bridge2Internet src-address=10.x.x.12 to-addresses=
69.x.x.161

These will only work if you access them from somewhere outside the network.

How do I get them to work from inside the network? They’ve worked in previous setups.

2

I would guess you need hairpin nat setup.

http://wiki.mikrotik.com/wiki/Hairpin_NAT

3

Thanks cbrown, That makes sense… I’ll try it out.

4

Oddly enough that doesn’t seem to be working properly. I’m running a fairly large firewall with over 200 rules, mainly 1-to-1 IP address assignments to customers inside the network.

5

So post the rule sets you have. It’s much easier to have an opinion on actual configuration than to wildly guess. Far less frustrating for both the people helping and the person asking for help, too.

6

Here’s a summary of my rules. I have a lot more, but this provides a sample of the significant rules.

/ip firewall nat
add action=masquerade chain=srcnat comment=
“Masquerade Internal to Internal Traffic” disabled=yes dst-address-list=
Internal src-address-list=Internal
add action=dst-nat chain=dstnat comment=“########” disabled=no dst-address=
69.##.##.### to-addresses=10.##.##.##
add action=src-nat chain=srcnat comment=“########” disabled=no out-interface=
bridge2Internet src-address=10.##.##.## to-addresses=69.##.##.###
add action=masquerade chain=srcnat comment=“BOTTOM RULE” disabled=no
out-interface=bridge2Internet src-address-list=Internal

/ip firewall address-list
add address=10.0.0.0/8 disabled=no list=Internal
add address=192.168.0.0/16 disabled=no list=Internal

7

That first NAT rule is disabled. It would perform the hairpin NAT function.

8

Whether it’s enabled or not hasn’t made a difference.

9

From what you posted it should be working with the rule enabled. Traffic from internal to the public would first hit destination NAT and be directed back to internal, and would then hit source NAT to be masqueraded to the router IP as required for hairpin NAT.

Have you looked at other configuration besides NAT? Firewall filters, etc.?

10

Thanks Fewi,

Hairpin NAT did end up working in the end.