For the scenario where the router will sit in front of every devices that will "use" those 1.10.100.115-1.10.100.126 addresses (for instance servers or VMs), because the router needs to do firewall filtering duty for example, there is a way to do that involves no NAT:
-
In
/ip addressthe address entry associated withether1should beaddress=1.10.100.114/32 network=1.10.100.113, instead ofaddress=1.10.100.114/28 network=1.10.100.112. -
In
/ip routethe static default route is stilldst-address=0.0.0.0/0 gateway=1.10.100.113. -
Add 12
published=yesARP entries onether1for the addresses1.10.100.115-1.10.100.126:/ip arp add address=1.10.100.115 interface=ether1 published=yes add address=1.10.100.116 interface=ether1 published=yes add address=1.10.100.117 interface=ether1 published=yes # ... add address=1.10.100.125 interface=ether1 published=yes add address=1.10.100.126 interface=ether1 published=yes -
On the bridge or VLAN or ethernet interface where the servers / VMs with public IP addresses will reside, configure the
/ip addressentry. Let's assume the interface is calledservers:/ip address add address=1.10.100.114/28 interface=servers network=1.10.100.112Note that here we give the router the address
1.10.100.114too, although the router already has the same address onether1, that's not a problem. -
Add static published ARP entry for
1.10.100.113on thisserversinterface:/ip arp add address=1.10.100.113 interface=servers published=yesNote the interface here, it's
serversnotether1! -
Now we can either manually assign static addresses for hosts connected to the
serversinterface, with addresses in the range1.10.100.115-1.10.100.126, default gateway should be set to1.10.100.114. -
Or alternatively we can just setup DHCP server on the
serversinterface with the correct information:/ip pool add name=dhcp-servers ranges=1.10.100.115-1.10.100.126 /ip dhcp-server network add address=1.10.100.112/28 dns-server=1.10.100.114 gateway=1.10.100.114 /ip dhcp-server add address-pool=dhcp-servers interface=servers name=dhcp-serversAnd of course, it's preferable to add static leases on this DHCP server because we don't want the devices' addresses to jump around!
-
In case we have a
masqueraderule onout-interface=ether1that perform SRCNAT going to the WAN, then we need to modify this rule to exclude the devices that already have the public IP addresses from being NAT-ed. The rule will modified to be something like:/ip firewall nat add action=masquerade chain=srcnat out-interface=ether1 src-address=!1.10.100.112/28 -
Adjust the firewall
filtertable with rules that explicitly allowed incoming traffic to the addresses and ports of the devices inserversif needed.
After doing this, we'll have hosts/servers/VMs in attached to the servers interface with true public IP addresses. They will be able to go out to the internet with their own public IP addresses as source addresses, and no NAT will be performed.
If the filter rules are correct, they wil be also be able to directly accept incoming connections from the outside, to the allowed ports and services hosted on them, using their own public IP addresses as destination. No DSTNAT is involved.
Here is my test config to confirm the above is working as intended:
