Hello! One om ny clients wants to use RouterOS instead of some D-Link DFL firewall/router and having need in its SAT translation mechanism. How to make RouterOS to replace both source and destination addresses when translating a packet from public to internal network?
The example:
I connect from internet to the router with an external address of 11.11.11.11 and internal address of 192.168.1.1/24. In the internal network, there is a server with 192.168.1.201 IP address. I need to publish its TCP 4489 port under 10001 public port. I usually solve it with srcnat + dstnat rule pair, like this:
ip fire nat add chain=src src-addr=192.168.1.201 proto=tcp src-port=4899 action=src-nat to-addr=11.11.11.11 to-port=10001
ip fire nat add chain=dst dst-addr=11.11.11.11 proto=tcp dst-port=10001 action=dst-nat to-addr=192.168.1.201 to-port=4899
With these rules, the router receives the packet from internet, replaces the destination address 11.11.11.11 and destination port 10001 and throws the packet in the internal network to the server 192.168.1.201:4899. And when the server replies, router replaces packet’s source address and port back to 11.11.11.11:10001 and sends it across the internet.
But now I need to replace BOTH source and destination addresses in BOTH packets:
Received from internet:
Src-addr=x.x.x.x, Dst-address=11.11.11.11, Proto=tcp, Src-port=x, Dst-port=10001
Translated and put to internal network:
Src-addr=192.168.1.1, Dst-address=192.168.1.201 Proto=tcp, Src-port=x, Dst-port=4899
Received from server:
Src-addr=192.168.1.201, Dst-address=192.168.1.1 Proto=tcp, Src-port=4899, Dst-port=x
Translated and sent to internet:
Src-addr=11.11.11.11, Dst-address=x.x.x.x, Proto=tcp, Src-port=10001, Dst-port=x
Doing it as usual, it didn’t replace source addresses (as intended, actually). Netmap didn’t work too - it didn’t replace source address when translated the incoming packet from internet, though it was suggested to do it.
Any idea?
Rewrite source NAT rule as follows