I’m brand new to Mikrotik and am working on implementing the CCR1072-1G-8S+ as the main router for our subnets. So far it is doing the routing great so I wanted to also add firewall and NAT to it’s functionality since our firewall has only given us problems. I configured the rules and added the port forwarding but I got stuck on, what I thought would be, a very simple configuration. Right now the firewall sits at 192.168.10.1 with the ether1 connection on the router being 192.168.10.2. The router’s default gateway is set to 192.168.10.1 and all works great.
I thought it’d be as simple as changing the router’s ether1 address to the public IP, and set the default gateway to the WAN gateway, just like what the firewall has. Unfortunately I lost internet on all of our subnets when I made this change. However, the router could reach the internet just fine. When I did a tracert on a Window machine behind the router it successfully got to the router then failed. But if I SSH directly to the router, it can reach everything on the LAN and WAN side with no issues. I must be missing something because this is very strange behavior. I disabled all firewall and NAT rules to verify I didn’t misconfigure anything or inadvertently block my traffic. See the configuration below for what it currently is set as. The only change I’m thinking it needs to make ether1 work as my WAN connection is change the IP address and the default gateway to what the WAN is specified as. Is there something else I need to do?
I must be missing something because this is very strange behavior. I disabled all firewall and NAT rules to verify I didn’t misconfigure anything or inadvertently block my traffic. See the configuration below for what it currently is set as. The only change I’m thinking it needs to make ether1 work as my WAN connection is change the IP address and the default gateway to what the WAN is specified as. Is there something else I need to do?
Does it also happen if you disable firewall, but not NAT masquerading? You need masquerading!!
Assign the public IP address (guess this is what you meant) to the public interface, make sure you can reach the gateway and can ping to the outside from the routerboard.
This being set all, you need for the rest of the network to reach internet is masquerading.
Thank you for the help! It was in fact the masquerading that was missing. From my config you can see I configured it (since I read about it somewhere) but it looks like I never actually enabled it. Once the rule was enabled then everything worked great.
Telnetpr, while you’re not wrong, this config wouldn’t be applicable in a multi-subnet environment. I could have configured a bigger subnet as well but it was easiest just to use:
out-interface=WAN
(renamed ether1 to WAN to ease confusion) then to specify a specific subnet. Unless you see any reason to not do that?
Appreciate the help guys. Being new to MikroTik it’s a little intimidating but I think I’m getting the hang of it!
Oh interesting, I never thought of doing that. Do you do this so you can keep certain subnets off the internet? I’m implementing a rule like that but instead I just blocked traffic from subnet X to WAN. It might just be solving the same problem two different ways but I’m curious about your application and why you went that route.
It’s better to block traffic than to just break it by breaking layer 3… (see below)
Confusedwan - I recommend your method over telnetpr’s method. If you “block” internet access by not doing masqerade, then outbound packets from the un-masqueraded LAN will still go out to the Internet, and now your network is a source of traffic with “fake” source IP addresses on it.
It’s best practice to do each job with the correct portion of the firewall - NAT is simply there to map IPs from one to another so that everything is reachable. If you want to affect policiy and block certain kinds of traffic, then do this with filters. Later, if X cannot reach Y, then you know to look in filters.
The simple fact of the matter is that in a single IP / single WAN environment, anything going out the WAN must have the single IP address on it or else it won’t work, so configure NAT accordingly. That way, any packet that does follow this path will work properly. If you want to disallow packets from taking that path, it’s logical that this be done in a filter policy and not a “well, it’s a broken path if an unauthorized host was trying to use it” scenario.
