masquerade causing issues

RouterOS General
1

Hi

Im having issues with something very simple here. all network traffic is masqueraded. However some clients need external ips. I have done this this scr and dst nat rules. i can ping and access my pc externaly.

now for the strange bit. Some services dont work like echolink. the only way i can get them to work is by disabeling the masquerade rule, then they work 100% but ofcorse all other non external ip’s have no connectitivity!!!

Any ideas why the masquerade rule will interfier or what i can use as an alternative to the masquerade rule.

Thanks

2

A guess…

Would the order of rules matter?

So dstnat first?
Also, do you exclude you real IP users from the masq?

3

Thanks for the help, i aranged as you recomended and ensured masquerade rule is last on the list, still the same.

How would you exclude real ip users from the masquerade? Infact i have done this with one client by adding an ! next to his ip in the masquerade rule, this then works for his ip, but you can only add one ip rule like this.

But i think thats on the right track, any further sudgestion to exclude the ip’s from the masquerade?

Thanks again

4

Create a list of all IPs to be excluded in ip–> firewall–> address-list, then apply this list with a ! in “src-address-list” of your masquerade rule.

5

Thank you very much, The list trick is working.

Is this the correct way or is it a clever work-around.

Nether the less it worked great for me.
Thank you.

6

Nope. sorry this acutally did not work.

I recived a call this morning saying there is no internet to clients… after checking the masquerade rule i had left an ip in the wrong place, rendering the masquerade rule useless, but i still had connectivity as i have nated ip.

After checking recomended settings, certain services will not work with masquerade enabled to the natted ip’s, but perfect with it dissabled.

PLEASE HELP FURTER.

Thanks

7

GIve us export of your NAT rules and Ip addresses

8

Blush

Sorry, i have made the mistake, when adding the ip address to the list, by default they are dissabled. Enabling them cured fault.

Thanks again to everyone giving there time to help me.

Issue completely resolved.