How to route Secondary public IP without NAT over PPPoE

RouterOS Beginner Basics
1

Hi there,

I have 5 interfaces on my mikrotik:
Eth1: WAN (PPPoE)
Eth2,3 and 4: LAN (Bridged)
Eth5: LAN2 (to be used for another Public subnet IP)

I connect to my ISP through PPPoE. Once connected, my ISP assign a public IP (let’s say 10.10.10.209) to my WAN interface and I can surf without issue
I also have another Public Subnet (let’s say 50.50.50.248/30) and my ISP routed 50.50.50.248/30 block to me.

I configured IP address 50.50.50.249 to Eth5 and 50.50.50.250 on my PC plugged to Eth5
The PC can surf without Issue but when I check whatsmyip address, I always see the PPPoE IP (10.10.10.209) I tried to disable NAT (excluding Subnet 50.50.50.248/30) but once I did it my PC cannot surf

How can I configure the mikrotik to get my PC connected to Eth5 to surf without NAT

Below what I did:

STEP 1: Assigning IP Addresses to Mikrotik Interface Eth5
/ip address
add address=50.50.50.249/30 interface=Eth5 network=50.50.50.248

STEP 2: Create Firewall Rule to Allow Connections from Subnet

/ip firewall filter
add action=accept chain=forward connection-state=new out-interface=ether1 src-address=50.50.50.248/30

Thank you for your support

2

You can try to show us what exactly you did with srcnat. Or just whole firewall.

3

Hi Sob,
Below the export configuration:

[admin@MikroTik] > /export

sep/27/2018 09:55:47 by RouterOS 6.42.7

software id = LM2B-LKTN

model = RouterBOARD 750 r2

serial number = xxxxxxxxxxxx

/interface bridge
add admin-mac=54:51:D1:63:30:6C auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] mtu=1598
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 keepalive-timeout=disabled name=pppoe-out1 password=
SuPdrKxn user=Ben_office
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp2 ranges=50.50.50.250
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
add address-pool=dhcp2 disabled=no interface=ether5 name=DHCP2
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all internet-interface-list=WAN lan-interface-list=LAN wan-interface-list=WAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=50.50.50.249/30 interface=ether5 network=50.50.50.248
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=50.50.50.248/30 dns-server=8.8.8.8 gateway=50.50.50.249 netmask=30
add address=192.168.88.0/24 comment=defconf dns-server=8.8.8.8 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=
established,related,untracked
add action=accept chain=forward connection-state=new out-interface=ether1 src-address=50.50.50.248/30
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=yes distance=1 gateway=ether1
/system clock
set time-zone-name=Europe/Brussels
/system routerboard settings
set silent-boot=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

============================================

[admin@MikroTik] > ip route print
0 ADS 0.0.0.0/0 pppoe-out1 1
1 X S 0.0.0.0/0 ether1 1
2 DC 50.50.50.248/30 50.50.50.249 ether5 255
3 ADC 192.168.88.0/24 192.168.88.1 bridge 0
4 ADC 20.20.70.42/32 10.10.10.209 pppoe-out1 0

Thanks for your support
Cheers,

4

I was interested in this part:

Try to add this before current masquerade rule:

/ip firewall nat
add action=accept chain=srcnat src-address=50.50.50.248/30

Your STEP 2 is useless, firewall already allows outgoing connections. But if you want also incoming, add this before the last drop rule:

/ip firewall filter
add chain=forward dst-address=50.50.50.248/30 action=accept

If it still won’t work, check that the subnet is correctly routed to you. Add this:

/ip firewall mangle
add chain=prerouting dst-address=50.50.50.248/30 in-interface-list=WAN action=log

and then try to send something to 50.50.50.250 from outside (e.g. using some online pinger). You should see incoming packets logged.