12 Devices with same ip NAT to a different Network

Hello,

could someone help if i can solve the following issue.
I have 12 devices which must have the same IP. A Server has to connect to each and get some information's. I thought that i can setup 12 VLANs put all 12 different devices to the VLANs and NAT each VLAN to the Server Network. I tried to simulate this via GNS3 with CHR but it seems without the LVL6 License are VRFs not working. Wanted to build the gateways through the VRFs, but i think this did not worked because of the missing License. Can someone tell me if this will work if i buy a CCR2004-16G-2S+. Don't want to invest if the idea is not working at all. Phoenix Contact has NAT Switches where it is possible to set NATs for VLANs. But if i can do it with Mikrotik would be happier :slight_smile:

Lab Setup Idea: Multiple PCs with the Same IP via MikroTik CHR + VRFs

  • Build a lab where multiple PCs (VPCs) all use the same IP address (172.80.10.1/24).
  • Each PC is fully isolated in its own VLAN/VRF.
  • All PCs can reach a central server (10.144.100.2/24) on ether8.
  • PCs must not communicate with each other.

Approach

  1. VLAN per PC
  • Each PC is assigned a dedicated VLAN on the CHR (e.g., VLAN101 → PC1, VLAN102 → PC2, etc.).
  1. VRF per VLAN
  • Every VLAN is placed into its own VRF (routing table).
  • Each VRF has the same gateway IP (172.80.10.254/24), but because of VRF separation, they don’t conflict.
  1. NAT toward the server
  • Source NAT translates traffic from each VRF into the server subnet (10.144.100.0/24).
  • Each VRF can use a unique NAT address inside 10.144.100.x, so the server can distinguish clients.
  1. Firewall rules
  • Inter-VLAN/VRF traffic is blocked.
  • Only VRF → Server communication is allowed.

Topology

PC1 (172.80.10.1/24 gw 172.80.10.254) --- VLAN101 --- VRF101 ---+
PC2 (172.80.10.1/24 gw 172.80.10.254) --- VLAN102 --- VRF102 ---+
PC3 (172.80.10.1/24 gw 172.80.10.254) --- VLAN103 --- VRF103 ---+--> CHR --- VLAN108 --- Server (10.144.100.2/24)
...

Thanks in advance for your help!

Hi,

check this

There have been so many people that came to the forum with the same requirements as yours, and one of them has taken the time to write a guide:

Quick Guide: Bidirectional 1:1 NAT (SNAT, DNAT) Setup w/ working example - RouterOS / Useful user articles - MikroTik community forum

You should also read the posts from @lurker888 in the thread linked by the guide: 1:1 NAT / DNAT configuration help - RouterOS / Beginner Basics - MikroTik community forum.

Couldn't find them ... sigh....

Thank you, so it seems i doesn't even need VRFs.

When the problem is properly described, question properly asked, then it's much, much easier to find a solution.
Same types of problems recur again and again.

Yep, this comes up twice a month. Some comments:

  • The Phoenix Contact etc. industrial devices don't actually do what you want
  • There was a thread specifically about device choice for this sort of thing, which should really be included in the standard advice set; it also addresses licensing fears (spoiler: you shouldn't have any):
  • Long short: if you have something even remotely industrial, do yourself a favor and choose a device that doesn't require active cooling - the ccr2004 has a -PC variant that's passively cooled
  • If you have such a large number of devices, the best approach is usually not to use physical interfaces for each device, but to have those networks exit the router on different VLANs (possibly on a single port), which are then distributed through normal (managed/vlan-aware) switches. In this case I would strongly suggest the "Hex S 2025" model for the router - despite its unimpressive looks and low price, it's actually the best for this kind of job. (Any worries that "such a small device - how many devices can it handle?" and such can be safely put aside. It can handle a lot more than 12.) As a side benefit it's kind of indestructible.

Part of any new poster sandbox process, besides jaclaz 12 rules reading, network diagram, config export and stating requirements/use cases for traffic flow, the ability to search the Forum would be another tool one would have to show some basic proficiency!!

Maybe also useful: