Help with some public ip`s and 1:1 nat

RouterOS Beginner Basics
1

Good morning. I’ve following situation:

  • /30 ip block assign from isp through my internet connection. Let’s say xxx.xxx.xxx.160/30.
  • Some vps’s on internal vlan. 10.0.0.0/24
  • Following 1:1 nat rules
0    chain=dstnat action=netmap to-addresses=10.0.0.13 dst-address=xxx.xxx.xxx.161 log=no log-prefix="" 

 1    chain=srcnat action=netmap to-addresses=xxx.xxx.xxx.161 src-address=10.0.0.13 log=no log-prefix=""

Rules for accepting input connection on corresponding ports are in place.

My problem is as follows:

  • I cannot acces 10.0.0.13 server from another vps 10.0.0.10. I can ping
meister@ch3:~$ ping xxx.xxx.xxx.161
PING 190.52.167.161 (xxx.xxx.xxx.161) 56(84) bytes of data.
64 bytes from 10.0.0.13: icmp_seq=1 ttl=64 time=0.637 ms
64 bytes from 10.0.0.13: icmp_seq=2 ttl=64 time=0.466 ms
64 bytes from 10.0.0.13: icmp_seq=3 ttl=64 time=2.76 ms
64 bytes from 10.0.0.13: icmp_seq=4 ttl=64 time=0.435 ms
64 bytes from 10.0.0.13: icmp_seq=5 ttl=64 time=0.460 ms

But I cannot make a telnet connection. It stays at Trying. I can succesfully acces from the outside.

meister@ch3:~$ telnet xxx.xxx.xxx.161 25
Trying 190.52.167.161...
2

You need to set up hairpin nat if you want to access public IP natted to devices located in the same network:
http://wiki.mikrotik.com/wiki/Hairpin_NAT

3

Thank you mrz! That’s the rule that was missing.

 0    chain=srcnat action=masquerade src-address=10.0.0.0/24 dst-address=10.0.0.0/24 out-interface=vlan10_esxi log=no log-prefix=""