I have devices on a private ip network (172.16.101.x) that need to have access to public IPs. For example they need to get the time from a public time server. Currently these devices cannot ping anything public. Devices on the same network that have public IPs work fine.
How to I let devices on a specific IP range (i.e 172.16.101.x /24) reach public IPs?
Thanks,
Gary
There’s this wildly popular thing called NAT. It allows to hide one or more private addresses behind public address, which makes communication with the rest of internet possible. It’s just hard to believe that someone who knows what private and public addresses are, would not know about it. 
Anyway, the rule can be e.g.:
/ip firewall nat
add chain=srcnat src-address=172.16.101.0/24 out-interface=<WAN interface> action=src-nat to-addresses=<public address>
Assuming that the router has , 172.16.101.x devices have this router as their default gateway, no other firewall rules block it on this router or others, it should work.
You have to pay for them from your ISP and then you can map 1:1 devices to the extra public IPs.
If you mean you want people to be able to reach your devices through your existing WAN, that is called destination nat or port forwarding.
@Sob, nice try but weak, leave the sarcasm part to me - an MTUNA certified AC (Ascerbic Consultant)! 
@anav: You should get some advanced reading classes (or glasses?):
There are already public addresses, plural. So logically, they know about private and public addresses, but not about NAT => we have here a time traveller from last century, early 90s or before (edit: that may be wrong, so far I see 172.16.x.x in RFC1597 from 1994, but not before that). It’s completely obvious.
Well your crystal ball is obviously german made, I think I got the cheapo Chinese knock off ;-(
In any case the Ops post is not exactly clear!
I will watch you assist and learn.
Hi, I appreciate your technical help!
In this case the router is a gateway to the internet and has a x.x.x.1 ip. All the user routers have a static public ip in the same /24 but my infrastructure microwave radios (about 175 of them and 7 towers) are on the 172 net. I currently manage them via a local computer on the 172 net. I want to migrate to a cloud management system but this requires that the radios can connect to it.
In your code example i assume that WAN port is the Ethernet port to the internet (in my case ether 0). Is the public IP the router x.x.x.1 address or do I select a different address in my /24 range?
Thanks (and do remember this is the Beginner Basics forum.
Gary
Yes, out-interface= is the one connected to internet, the idea is that it should apply only to packets going to internet and not affect communication with some other local subnets.
What to-addresses= you choose is up to you. If you have spare ones, you can dedicate one for this (you may or may not need to add it to router, it depends how exactly is the config done), but you can also share the one that router already has.
And nothing against beginners, it’s fine to not know something, but it’s suspicious to know something about networks and not about NAT.
S.O.B. : Suspicious Omnipotent Bafflegab, my favourite kind of person.