Hi everyone,

I Have a customer that has 5x IP addresses allocated to them from their ISP.

They would like the internal LAN to cycle through these IP addresses randomly (for outbound traffic) when they using the internet.

Can you please describe a source NAT rule that will do this?

Thank you,

Richard

Why a source NAT rule?
I presume that some routing rule would be more suitable, or a change of the routes in the main routing table, but in both cases there would be the need for a script to generate the next “random” IP to be used and facilitate the change (there would be the issue with existing connections when you make the change, won’t it?).
Also, how often should the change be made (like every 10 minutes, 2 days or 1 week? Or should it also happen at “random” intervals))

Something like this ?

http://forum.mikrotik.com/t/netmap-vs-srcnat/143946/1

I have no clue on how ISPs dole out blocks of IPs…
My first thought was, use all 5 as separate WANS and load balance between them

If customers purchase a so called “ip-pack” with us anyway, they get 5 adjacent/consecutive IP’s.
depending on the config, that could 1 public fixed IP and the above 5-block routed to it for example.

Cycle or randomize are different things. You cannot do this with a NAT rule alone. And while “netmap” is very useful, not sure it can help here.

One way a “random” (per connection) change happen using ECMP route on gateway. @jvanhambelgium’s /29 ISP to customer is pretty common, as add-on to ISP. But in these kinda “/29 to customer”, the IP address are within the same subnet and L2 segment - the later make it a little tougher to use the “usual” multi-WAN things (possible just all firewall rules have IP-based matchers, which is not the default).

The easiest way in recent V7 version is using a MACVLAN. The basic steps:

1. Create new /interface/macvlan & have it listen on the WAN interface (ether1 typically)
2. Add /ip/address to new macvlan using an unused public IP from your IP
3. Add it to the “WAN” interface list. Or perhaps better a new src-nat to public IP using in-interface=macvlan in /ip/firewall/nat
4. Add /ip/route 0.0.0.0/0 router with gateway=macvlanX — at same distance= as your existing default gateway /ip/route
5. In /ip/route a “+” should appear next your the 0.0.0.0/0 for WAN/ether1, and the new MACVLAN using a 2nd public IP.

At this point, the LAN clients should be “load balanced”, or at least internet going out two different interface.

The way it works is NAT will select the IP of the interface it’s using, based on /ip/route “randomizing” between routes with the same distance=. ECMP, used here, is based on just src/dst address - so it’s not really that random but should be divided between all the same /ip/route distance= routes.

And ignoring the “why” question here… the extra IP are more for being able forward the same ports inbound to different device (using ports like 80/443/etc from 2nd, 3rd public IP assigned)…or put some server directly on the internet without the router…not load balancing them to achieve no speed advantage just occasionally different IP going outbound…

Thanks Everyone,

I have some more information:

The customer wants to cycle through 5x IP addresses every 24 hours. ie 1x different public facing outgoing IP address for the internal subnet browsing, each day then it starts the cycle again.

They don’t have to be randomised, just to cycle throught the 5x that they have daily.

Regards,

Richard

Seriously?
What is the reason?
Its starting to smell like your client is doing something illegal and suggest you dissolve your relationship.
Either that or the client is going to make your life difficult with a continuous stream of over the top requirements based on what ???

Despite the reason the simplest solution is to make a script dropping all connections and assigning “next” IP and let it execute every 24 h
WAN NAT rule should be set to mascarade to change the IP only, not the NAT rule too.

Assigning the next IP?? That doesnt sound random LOL.

I'm with @BertozP if need is just daily... use /system/schedule that's set interval of 1d.

The following should work. You'd have to change the list of IP addresses to rotate, and the /ip/address that will be rotated must of the comment "cycle" (no spaces, but you change in the script). The rest of the script just uses the day of the month & modulo % operator on # of IP to rotate. So in theory, if you wanted to rotate more or less IP in the list, script still work.
{

list of ip address to rotate between

:local addrs (4.2.2.1/29, 4.2.2.2/29, 4.2.2.3/29, 4.2.2.4/29, 4.2.2.5/29)

comment on /ip/address to find what to update

:local findComment "cycle"

next address calculated using variables above

run at most once per day (look for reminder from current day divided by # address

:local index ([:tonum [:pick [/system/clock/get date] 8 10]] % [:len $addrs])

for debug, update, at most, every second

:set index ([:tonum [:pick [/system/clock/get time] 6 8]] % [:len $addrs])

find ip address entry to update

:local before [/ip/address/get [find comment=$findComment]]
:if ([:typeof $before]!="array") do={:error "[:jobname] failure - no ip address to update"}
/log/debug "$[:jobname] rotating ip address for $($before->"interface") from $($before->"address")"

rotate it based on index into list of address

/ip/address/set [find comment=$findComment] address=($addrs->$index)

:local updated [/ip/address/get [find comment=$findComment]]
/log/info "$[:jobname] rotating ip address for $($updated->"interface") from $($before->"address") to $($updated->"address")"
}
n.b. Same approach work if you wanted to change the a src-nat rules - large change /ip/address to /ip/firewall/nat commands to use right attributes. Since I'm not sure of the use case, other than potentially appeasing a customer request, hard to know if change IP vs change a NAT rule is better/worse. Since default is masquerade already, changing /ip/address should just work.

What happens to the /ip/firewall/connections situation when this happens IDK. i.e. whether a flush would happen if /ip/address and/or /ip/firewall/nat, or perhaps be they remain using "old" for lifetime. But how you'd want to deal with connection be the 2nd part here.

That is why I used quotes around the next word. You lost the edge … Amm0 caught the idea
More “random” generator is described there: http://forum.mikrotik.com/t/pseudo-random-number-generator-script-mersenne-twister/51962/1

It’s all pseudo-random anyway. There is a “Julian-Gregorian twister” here since the cycle will change between 30|31|29|28 to 1 in above script as it use the day of the month which can break the cycle .

If you want a more random one, change the index to be a random number. V7 has a built-in [:rndnum] to do these things nowadays. So above changes slightly if that’s what’s needed:

Change “:local index” line in above script to this

:local index [:rndnum from=0 to=([:len $addrs] - 1)]

How did you manage to format the “code box” as in the previous post “script for schedule to rotate IP address from a list code” ??

Code2 instead of code:

Normal code

Code 2
a title is needed, I beleve.



[ code]
Normal code
[/code]


[ code2=title]
Code 2
[/code2]

Grreat, thanks! Are there any other hidden gems for phpBB that can be used in this forum?

Hard to say.
AFAIK there are three “levels”:

1. standard bbcodes included in the specific phpbb version
2. optional/additional bbcodes that may or may not have been added
3. whatever the board administrator chose to allow or disable

Credit to @rextended for “code2=title”.

In tips, there is CPAN module “md2phpbb” - that takes Markdown and gets almost-Mikrotik-forum phpBB. I used that to take a GitHub README.md to make a forum post: http://forum.mikrotik.com/t/serial2http-container-to-bridge-serial-to-the-routeros-cli/164589/16