DST-NAT for multiple wan addresses

Here is why:

Mainly, because when this is fully up and running, i will have likely 10-20 Mikrotiks, each with 3 WAN IPs (router, PLC, HMI), all in 10.0.80.0/24 network. And on each LAN of those Mikrotiks will be the actual PLC and HMI devices, which on half of them are sitting at 192.168.250.1 and 192.168.250.100, other half is semi-randomly placed in 192.168.xxx.xxx land.

There are the same IP’s on different machine network islands and he wants to check signals from all of them.

And to the author:

The machine islands of PLC+HMI sets will not and should not talk to each other at all, I just need them accessible from one server which will be sitting in 10.0.80.0/24, same as MIkrotik WANs.

It’s quite good for you because in different scenario you would struggle with it especially if they would be treated as a part of bigger machine/process where signal and data time synchronization is crucial. But it’s not your case, we don’t need to look at it :slight_smile:

//EDIT and about the OT network devices programming, I have seen multiple approaches. One is VPN per machine, one is VLAN per machine and then in the office there is one switch port where engineer will change VLAN to his target network and then commences whatever he needs to do in machine subnet.

VLAN’s are the thing in my environment but won’t help you without changing IP addressess on PLC’s and HMI’s to unique ones so openVPN sounds great.