Changing source IP from inbound connections

RouterOS General
1

Hello,

I have the following scenario: my router has a WAN IP 192.168.2.100 and LAN IP 192.168.0.1
I also have a server on the LAN with IP 192.168.0.100 listening on port 8085 that has to be available from the WAN. I have already set-up a destination NAT to redirect 192.168.2.100:8085 to 192.168.0.100:8085.

However, because of reasons that are out of my control, the server cannot answer to requests whose source IP is outside of 192.168.0.0/24. What I would like to implement is to change the source IP of all requests coming from the WAN to a fake IP in the LAN, let’s say 192.168.0.10 and let the router perform the source adresse translation.

I have tried many source NAT rules, but none of them work as they should. Most examples include a src-address field, which is unknown in this case.

What would be the proper way to implement this behavior ?

2

You don’t really need to always match src-address for src-nat.
In your case you can match these packets by dst-address=192.168.0.100.

3

Hello,

I have tried to add the following rule

 7    chain=srcnat action=src-nat to-addresses=192.168.0.10 protocol=tcp dst-address=192.168.0.100 log=no log-prefix=""

But for whatever reason it does not work.

I have added another small server with a mock apache-based website to my LAN to try to isolate the problem.
After setting a simple dnat I can access the server from the WAN. However it stops being accessible when I enable the source nat rule.

When I run nmap, it displays the port as “filtered”

4

The address in to-addresses can’t be too fake, because server will see traffic coming from it and it will try to send responses there. And since the address is in local subnet, it must respond to ARP requests. Easy fix is to add it to router as second address on same interface where you have 192.168.0.1.

5

This worked , thanks to you both !