Additional public IPs routed to host in LAN

RouterOS General
1

Hi,
I have following configuration: Router with 1.2.3.133/25 on ether1 (WAN) interface. /25 is not a mistake, ISP assigned 5 IPs in total within /25 network slice and control it by MAC:
1.2.3.250/25
1.2.3.251/25
1.2.3.252/25
1.2.3.253/25

Basically 1.2.3.133 has its default GW pointing to 1.2.3.129 (which is first usable address in this /25 slice). NAT for two bridges for two local networks in Bridge1 and Bridge2 is working fine as expected. Now I’d like to route one of the additional public IPs (253) to host in local network, made exceptions in filtering but I can’t make it working. Also I am not entirely sure if I should configure this host with .129 or .133 (my mikrotik router) as gateway. So far I’ve tried both but with no luck. I must be missing something.

/interface bridge
add admin-mac=64:D1:54:3D:DD:6F auto-mac=no comment=G name=bridge1
add comment=K name=bridge2
/interface wireguard
add comment=G listen-port=13231 mtu=1420 name=server-g
add comment=K listen-port=13232 mtu=1420 name=server-k
/interface list
add name=WAN
add name=LAN
/ip pool
add name=G ranges=192.168.100.50-192.168.100.254
add name=K ranges=192.168.101.50-192.168.101.254
/ip dhcp-server
add address-pool=G interface=bridge1 name=G
add address-pool=K interface=bridge2 name=K
/interface bridge port
add bridge=bridge1 comment=defconf disabled=yes interface=ether1
add bridge=bridge1 comment=defconf interface=ether2
add bridge=bridge1 comment=defconf interface=ether3
add bridge=bridge1 comment=defconf interface=ether4
add bridge=bridge2 comment=defconf interface=ether5
add bridge=bridge2 comment=defconf interface=ether6
add bridge=bridge2 comment=defconf interface=ether7
add bridge=bridge1 comment=defconf interface=ether8
add bridge=bridge1 comment=defconf interface=sfp9
add bridge=bridge1 comment=defconf interface=sfp10
add bridge=bridge1 comment=defconf interface=sfp11
add bridge=bridge1 comment=defconf interface=sfp12
/interface list member
add interface=ether1 list=WAN
add interface=bridge1 list=LAN
/interface wireguard peers
add allowed-address=172.16.101.2/32 comment=K interface=server-k \
    public-key="xxx"
add allowed-address=172.16.101.3/32 client-address=172.16.101.3/32 comment=\
    mobile interface=server-k public-key=\
    "xxx"
/ip address
add address=192.168.100.1/24 comment=G interface=bridge1 network=\
    192.168.100.0
add address=1.2.3.133/25 interface=ether1 network=1.2.3.128
add address=192.168.101.1/24 comment=K interface=bridge2 network=\
    192.168.101.0
add address=172.16.101.1/24 comment=wg-server-k interface=server-k network=\
    172.16.101.0
add address=172.16.100.1/24 comment=wg-server-g interface=\
    server-g network=172.16.100.0
add address=1.2.3.253/25 comment=server interface=bridge2 \
    network=1.2.3.128
/ip dhcp-client
add disabled=yes interface=ether1
/ip dhcp-server network
add address=192.168.100.0/24 dns-server=1.1.1.1 gateway=192.168.100.1 \
    netmask=24
add address=192.168.101.0/24 dns-server=1.1.1.1 gateway=192.168.101.1 \
    netmask=24
/ip dns
set servers=1.1.1.1,8.8.8.8
/ip firewall address-list
add address=192.168.100.0/24 comment=LAN-G list=trusted
add address=192.168.101.0/24 comment=LAN-K list=trusted
/ip firewall filter
add action=accept chain=input comment="allow wireguard server G" \
    dst-port=13231 protocol=udp
add action=accept chain=input comment="allow wireguard server K" dst-port=\
    13232 protocol=udp
add action=fasttrack-connection chain=forward comment=fasttrack \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="accept established, related" \
    connection-state=established,related
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop invalid from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface=ether1
add action=accept chain=input comment="icmp reply" protocol=icmp
add action=accept chain=input comment="accept input, related" \
    connection-state=established,related
add action=drop chain=input comment="default drop input" in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment=NAT-G out-interface=ether1 \
    src-address=192.168.100.0/24
add action=masquerade chain=srcnat comment=NAT-K out-interface=ether1 \
    src-address=192.168.101.0/24
add action=masquerade chain=srcnat comment=wireguard-k out-interface=server-k
add action=masquerade chain=srcnat comment=wireguard-g out-interface=\
    server-g
add action=masquerade chain=srcnat comment=wireguard-k-nat out-interface=\
    ether1 src-address=172.16.101.0/24
add action=masquerade chain=srcnat comment=wireguard-g-nat \
    out-interface=ether1 src-address=172.16.100.0/24
add action=dst-nat chain=dstnat comment=Nginx-G-443 dst-address=\
    1.2.3.133 dst-port=443 protocol=tcp to-addresses=192.168.100.16 \
    to-ports=443
add action=dst-nat chain=dstnat comment=Nginx-G-80 dst-address=\
    1.2.3.133 dst-port=80 protocol=tcp to-addresses=192.168.100.16 \
    to-ports=80
add action=masquerade chain=srcnat comment=Hairpin-NAT-G dst-address=\
    192.168.100.0/24 out-interface=bridge1 protocol=tcp src-address=\
    192.168.100.0/24 to-addresses=192.168.100.16
add action=masquerade chain=srcnat comment=Hairpin-NAT-K dst-address=\
    192.168.101.0/24 out-interface=bridge2 protocol=tcp src-address=\
    192.168.101.0/24
/ip service
set telnet disabled=yes
set ftp disabled=yes
/ip ssh
set host-key-size=4096 strong-crypto=yes
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=crs112-8g-4s-in
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pl.pool.ntp.org
2

The key here is whether you indeed need the address to be routed there or whether bridging would be enough, and what kind of operating system does that host in LAN have. Assuming that

  • it must be routing,
  • the host in LAN can handle multiple addresses attached to the interface in LAN,
  • the host in LAN has a private address x.x.x.x and the public one you want to route to it is y.y.y.y,

you can just add a route to your Mikrotik: dst-address=y.y.y.y gateway=x.x.x.x and make your Mikrotik respond to ARP requests for y.y.y.y that come from the ISP router: /ip arp add address=y.y.y.y interface=your-wan-interface published=yes. A route with a longer destination prefix (y.y.y.y/32) has precedence over a route with a shorter one (y.y.y.128/25) no matter their distance.

On the LAN host, you would add the y.y.y.y as a /32 one to the interface, not as a /25 one.

3

What do you mean by saying bridging, 1:1 NAT? The host in LAN is Linux (VM) and can have multiple IPs/interfaces.

4

No, bridging would mean that you would physically connect the “LAN host” to a dedicated port on the Tik and bridge that port with the WAN one.

If the host is a Linux machine, what I described (additional /32 public address on the VM, route and published ARP on the Tik) should work. If you want the VM to initiate outgoing connections from the public address, it will require some more settings.

5

this is exactly what I want, do you know what settings?

6

In linux, you have to remove the default route and add it again, telling it to use the public address as source:
ip route add default via lan.ip.of.tik src y.y.y.y
In Mikrotik, you have to exempt packets with source address y.y.y.y from the src-nat or masquerade rule in chain srcnat of nat - this is easiest done by placing a rule src-address=y.y.y.y action=accept before (above) the action=src-nat (or action=masquerade) one, or instead by making the latter one(s) match on src-address-list=rfc1918 (so that they would only act on connections from private addresses, of course that assumes that you have that address list defined). Or just use src-address=prefix.of.lan.subnet/mask instead. Which way is the best one depends on the rest of your configuration.