Destination NAT with the replacement of IP source address

RouterOS General
1

Hello, there is one problem that I could not solve.
How can I configure the following:
Destination NAT with the replacement of IP source address, like Microsoft ISA/TMG Server (‘Requests appear to come from the ISA Server’ option)

Packet flow:

ExtIPc______ExtIPr_IntIPr____IntIPs
Client ------1-> Router-----2->Server
<-3-----------

Packet, stage 1:
Source IP: External Client IP (ExtIPc)
Destination: External Router IP (ExtIPr)

Packet, stage 2:
Source IP: Internal Router IP (IntIPr)
Destination: Internal Server IP (IntIPs)

Packet, stage 3:
Source IP: External Router IP (ExtIPr)
Destination: External Client IP (ExtIPc)

Thanks.

2

Configure both source and destination NAT rules. Destination NAT translates the destination IP address in the packet header of the first packet of a connection, repeats the same operation for all subsequent packets, and does the reverse for return traffic. Source NAT translates the source IP address in the packet header of the first packet of a connection, repeats the same operation for all subsequent packets, and does the return traffic. Source NAT happens after destination NAT, so when source NAT looks at the packet the destination IP has already been rewritten.

Consule the packet flow manual page for details: http://wiki.mikrotik.com/wiki/Manual:Packet_Flow

For example, let’s assume host 1.1.1.1 sends a packet to 2.2.2.2. You want the packet to go 3.3.3.3 instead, and to appear to be coming from 4.4.4.4.

/ip firewall nat
add chain=dstnat src-address=1.1.1.1 dst-address=2.2.2.2 action=dst-nat to-address=3.3.3.3
add chain=srcnat src-address=1.1.1.1 dst-address=3.3.3.3 action=src-nat to-address=4.4.4.4
  1. 1.1.1.1 sends to 2.2.2.2
  2. after the packet has traversed the destination NAT chain 1.1.1.1 sends to 3.3.3.3
  3. after the packet has traversed the source NAT chain 4.4.4.4 sends to 3.3.3.3
  4. 3.3.3.3 processes the packet and sends back to 4.4.4.4
  5. after the packet has traversed the destination NAT chain to undo the source NAT that happened the other way 3.3.3.3 sends to 1.1.1.1
  6. after the packet has traversed the source NAT chain to undo the destination NAT that happened the other way 2.2.2.2 sends to 1.1.1.1
3

It works. Thank you.

4

Can reply with diagram i have Mikrotik Barodband Router

5

Hi Fewi, I find your post very useful. I am available to send packets to monitor them. If possible to receive them whit their originally source ip. I am using wireshark. Thank you.

6

Hi fewi, great stuff, very useful!