Could my NAT rules be better?

RouterOS General
1

I just updated to a hex s, and I basically ported my rules over. Have there been any improvements or are there better ways I could be handling this NAT?

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="NAT HTTP" dst-address=<public IP> dst-port=80 protocol=tcp to-addresses=<internal server IP> to-ports=80
add action=masquerade chain=srcnat comment="Hairpin NAT HTTP" dst-port=80 out-interface=bridge protocol=tcp src-address=10.0.0.0/8
2

Do you do not deduce than 3 identical rule do the same thing?

add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
3

I don’t see how the first 3 rules (src-nat masquerade for internet-bound traffic) are different from each other, but likely one would suffice. And no need to explicitly set to-ports on dst-nat rule, that is only necessary if translated port (property dst-port) is different than target port (property to-ports), in your case they’re both 80.

Your hairpin src-nat rule could use some fine-tuning to make it more specific, such as adding dst-address=, the rule as it’s written now might masquerade more than bare minimum needed.

4

/ip firewall nat
add action=masquerade chain=srcnat comment=“Hairpin NAT HTTP” dst-address=10.0.0.0/24 src-address=10.0.0.0/24
add action=src-nat chain=srcnat ipsec-policy=out,none to-addresses= out-interface=wan_interface ***
add action=dst-nat chain=dstnat comment=“NAT HTTP” dst-address= dst-port=80 protocol=tcp to-addresses=

(1) For a fixed/static WANIP the provided source nat rule is more applicable, although one can still use the wider rule
add action=masquerade chain=srcnat comment=“defconf: masquerade” ipsec-policy=out,none out-interface-list=WAN

(2) If the WAN is based on a vlan or pppoe-1 connection the wan interface indicated is vlanX or pppoe-1out, and not the etherport#.

(3) To ports on dst nat rule not required if same as dst port.