Guys, another pazzle…
I have services inside LAN acceptable using NAT, including mail servers. They work as normal from outside world, but the time has come when I need them to communicate with each other. Unfortunately it’s not enough to just use Mikrotik’s own DNS service to indicate their LAN ip address, there must be also MX records etc. So it is required that one mail server to access another mail server using WAN ip address instead. How to do this?
Right now, I’m differentiating traffic by incoming WAN ip address and interface, like:
add action=dst-nat chain=dstnat comment="Email service to Server 1" dst-address=10.10.10.10 \
dst-port=25,110,993,995,143,587,465 in-interface=ether2 protocol=tcp \
to-addresses=192.168.10.10
add action=dst-nat chain=dstnat comment="Email service to Server 2" dst-address=20.20.20.10 \
dst-port=25,110,993,995,143,587,465 in-interface=ether2 protocol=tcp \
to-addresses=192.168.20.10
How to tell Mikrotik to accept packets from one mail server to another like it was outside LAN?
besides mail services they also act as a web servers. So they also can’t reach each other through WAN ip addresses, I have to exclusively set LAN ip address in the DNS server for individual web site I want to access from either machine, for example 192.168.10.10 IN A websitedomain.com, etc…
The dst-nat rules you already have, are almost fine. With exception: the “in-interface=ether2” stands in the way. So you can omit the “in-interface” property (but might cause some other problem, depends on the rest of NAT rules you have), or simply add similar pair of rules, but use src-address property instead of in-interface (to limit the NAT rule to act only on connections between both servers). Performance-wise it probably doesn’t much if you use single pair of dst-nat rules, slightly overloaded, or if you use additional pair of dst-nat rules.
Next you’ll probably need also src-nat rules … I’m assuming your src-nat rule also limits NAT to packets sent through ether2 interface. And you probably want the connection party to think it was connected from the other mail server using its public IP address as well. So construct a src-nat rule pair, smilar to this one:
(remember that src-nat is done as one of last steps in packet handling, way later than dst-nat (which is one of first steps) … so src-nat rule will see public IP address of destination)
