Hello,
I want to set 5 Public IP addresses to my WAN interface and local users can user dynamic NAT to my wan addresses. All those Public addresses have one gateway. It means some file sharing servers has permission from same public address, so local users can not download same time from Rapid share.
Replace your public IP addresses, and the WAN interface name.
/ip firewall nat
add chain=srcnat action=src-nat to-address=1.1.1.2 per-connection-classifier=src-address:0/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.3 per-connection-classifier=src-address:1/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.4 per-connection-classifier=src-address:2/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.5 per-connection-classifier=src-address:3/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.6 per-connection-classifier=src-address:4/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.2 out-interface=WAN
Thank you Fewi, I will try it.
Hello fewi,
I tried that but works only below rule.
add chain=srcnat action=src-nat to-address=1.1.1.2 out-interface=WAN
All traffics leave fules that set per-connection-classifier.
add chain=srcnat action=src-nat to-address=1.1.1.2 per-connection-classifier=src-address:0/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.3 per-connection-classifier=src-address:1/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.4 per-connection-classifier=src-address:2/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.5 per-connection-classifier=src-address:3/5 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.6 per-connection-classifier=src-address:4/5 out-interface=WAN
Please advise
I don’t understand the question.
Hi Fewi,
Sorry for mistake (not fules, RULES). I want to say that per connection classified NAT rules doesn`t work. All my traffics skip connection classified rules and directly run over main NAT rule.
add action=src-nat chain=srcnat disabled=no out-interface=INTERNET \
per-connection-classifier=src-address:1/5 src-address-list=STAFF \
to-addresses=X.X.X.137
add action=src-nat chain=srcnat disabled=no out-interface=INTERNET \
per-connection-classifier=src-address:2/5 src-address-list=STAFF \
to-addresses=X.X.X.138
add action=src-nat chain=srcnat disabled=no out-interface=INTERNET \
per-connection-classifier=src-address:3/5 src-address-list=STAFF \
to-addresses=X.X.X.139
add action=src-nat chain=srcnat disabled=no out-interface=INTERNET \
per-connection-classifier=src-address:4/5 src-address-list=STAFF \
to-addresses=X.X.X.140
add action=src-nat chain=srcnat disabled=no out-interface=INTERNET \
per-connection-classifier=src-address:5/5 src-address-list=STAFF \
to-addresses=X.X.X.141
add action=src-nat chain=srcnat comment=INTERNET disabled=no out-interface=\
INTERNET src-address-list=STAFF to-addresses=X.X.X.131
Here is stats:
36 srcnat src-nat 0 0
37 srcnat src-nat 0 0
38 srcnat src-nat 0 0
39 srcnat src-nat 0 0
40 srcnat src-nat 0 0
41 ;;; INTERNET
srcnat src-nat 3227098848 52688016
Where am I missing?
I had the numbers switched around (and you added another variant by not starting at 0).
/ip firewall nat
add chain=srcnat action=src-nat to-address=1.1.1.2 per-connection-classifier=src-address:5/0 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.3 per-connection-classifier=src-address:5/1 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.4 per-connection-classifier=src-address:5/2 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.5 per-connection-classifier=src-address:5/3 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.6 per-connection-classifier=src-address:5/4 out-interface=WAN
add chain=srcnat action=src-nat to-address=1.1.1.2 out-interface=WAN
Really really sorry… My fault 
Now it works. Thank you Fewi.
But in your first post the positions of numbers were changed
per-connection-classifier=src-address:0/5
and I tried to add 0/5 but it shows some error and I started to add 1/5,2/5 etc… Anyway I had to correct it.
Yeah, sorry - was going by memory.
Hi Fewi,
My rules works very nice. Now I`m using 10 public IP on router WAN side. But I have one more question. The boss gave me a task, that I need to set /24 IP block on WAN side. So I need to add 253 IP on network interface and need to add 253 source NAT rules. In this case, any other simple way? Will this rules eat my CPU usage?
You can use netmap as an action for the srcnat rule. This will dynamically NAT different private IPs out of different public IPs. As a side note however, you must feed it a complete subnet to use. So you’ll have to divide it up into several smaller subnets to get as many addresses in there that you can. You can use the same subnet size on the scr-address field to depending on your rules.
Also with action=src-nat you can define a range for it to use. I’ve had bad luck making that work for normal web browsing however.
I am using dma radius manager. I used this script my nas but sometimes later our one by one user disconnect my radius
This thread really helped me figure out how dynamic NAT behaves. Found this short write-up useful too: Dynamic NAT explained
netmap is more for 1:1, if u want to similar scenario for /24 probably u go with same
Interesting setup! You can definitely configure multiple public IPs for dynamic NAT on MikroTik. Check out the official NAT configuration guide on the MikroTik wiki for detailed steps and examples: https://wiki.mikrotik.com/wiki/Manual:IP/bluey coloring pages free/Firewall/NAT