Hi everyone,
I have two public IPs using PPPOe and I’m having a difficult time forwarding traffic from the second IP to my internal services. When I configured the connection I set a higher route distance for the second PPPOE connection since I don’t want it to load balance or anything. This is just for email to come in and for the web server.
Port forwarding is working great if I do it for the first IP (public IP).
From what I have read on the internet, I kind of have the feeling I need to use Mangle rules, just don’t know how. I have configure D-NAT rules setting the destination as the second public IP, but it is not working. I can’t even PING the second public IP even tough it is allowed in the firewall.
Most of the firewall rules are the default ones since this Mikrotik router just replaced yesterday a different router from another vendor.
Bellow is my firewall config, maybe someone can clear things out for me. Thanks in advance.
So I have created the bellow mangle rules thanks to this post https://www.reddit.com/r/mikrotik/comments/o2sfo1/how_do_i_port_forwarding_on_multiple_wan/ and it kind of works, but I am having an issue with my SMTP server.
The SMTP gateway is rejecting emails since they come from the internal IP address of Mikrotik. Is there any way I can fix this so it passes the public IP of the sender?
I see in your mangle rules you have indicated 2 wrong addresses at the beginning of each block: 192.167.10.7 (instead of 192.168.10.7) and 192.167.10.55 (instead of 192.168.10.55).
You can start debugging your problem by fixing those first.
Hi, thank for the reply.
Yes, it was late last night but the problem is the masquerading rule. If I masquerade the just the first public IP it works, I can see the public IPs of the email sender, but then I don’t have any internet on the machines.
In general when dealing with 2 WANs and the need to direct certain traffic to certain WAN, you have to create also a second routing table where you install the default route for the second WAN in there.
Then with mangle rules you can address with routing marks to reach the second routing table for traffic to exit and enter from the same side.
With wrong setup you end up with traffic exiting one way and reply being answered the other one, so connection gets broken.
If you have 2 WANs and you can’t define routes on the WAN devices, you will have to set SRC NAT for both your WANs and masquerading if they have dynamic IPs.
If you have disabled one SRC NAT, then you won’t have internet if your LAN is trying to get to internet through that WAN which does not have SRC NAT defined.
Here are my NAT rules. As you can see I have configure the masquerading rule only for the first public IP (PUBLIC_IP_01). This is the only way I found it working, but it disables internet on the machines that are using the second public IP.
As I said, if you disable SRC NAT on the second WAN, all LAN devices trying to use that route won’t get to internet, since your WAN2 router does not know anything about your LAN devices.
NAT with masquerading for WAN2 fixes that.
Also when using MANGLE and at the same time you have fasttrack enabled on your firewall forward chain, that is going to not make mangle rules to be working fine, as fasttrack bypasses those actions.
So you also have to exempt those mangled connection from being fasttracked.
As you have defined some connection mark in mangle, you can use that to make such exemption in filter rule for fasttrack
Just created another NAT rules for WAN2 but then the public IPs of the incoming email and web traffic (for the web server) are NAT-ed. Traffic appears to be coming from from the internal interface of the Mikrotik router and I don’t want that.
If you don’t want to use SRC-NAT for second WAN, then your only way to have traffic through WAN2 to reach internet is that you can define routing rules in the WAN2 device.
As I said before, if you can manage that router and set the return routes from that device back to your MikroTik router (where your LAN resides), then you can define the routes on how from WAN2 you can reach your LAN devices. In such case you can avoid SRC-NAT for WAN2.
About fasttrack rule, if you have disabled it then it’s not affecting your traffic, so you can leave it there if you like; just make sure it stays disabled as long as you use mangle, otherwise you can apply that change that I posted above where you are telling fasttrack to work only on connection which does not have any marker (given that your mangle rules assign markers to proper traffic).
I just replaced a Ubiquiti router with this Mikrotik that did all of the work without me setting routes on client machines. I can’t believe it cannot be done with Mikrotik the same way.
What I don’t understand is why does a masquerading rule hides the clients public addresses since the traffic is coming in and hits the web and SMTP gateway server. It doesn’t go out (at least to my thinking), except when I update the machines.
Here is my config just in case someone is having the same issue:
Remove the second public IP from the default route. Un-check Add Default Route from the interface
Manually create a new routing table Routing > Tables. Name it whatever you want.
Manually create a new route for the second public IP/PPPOE connection. If you also have a PPPOE connection like I do, in the Gateway box you need to put the name of the interface. It won’t not work if you type your public IP (at least for the PPPOE connection). Make sure that you select the new routing table that you just created.
Set you masquerading rule to send traffic only on the first public IP/PPPOE connection. This will cause another problem with the hairpin NAT rule if you have one, in that it is not going to work anymore.
It should work now, your internal server should get the public IPs of clients that connect to it. This is what I have used, so maybe it will work for you also.
