Multiple public IPs order & PPTP VPN

RouterOS Beginner Basics
1

Hello,

I have MikroTik router with two public IP addresses and then redirected to LAN IPs by NAT and one from them is used for internet connection by connected users. For example XXX.XXX.44.243 → 192.168.1.254, XX.XX.44.247 → 192.168.1.150.
The problem is, that router use first public IP with lower last number. So IP XXX.XXX.44.243 is first but I need to use XXX.XXX.44.247 as first and for users to connect to the internet.
Is possible to set router the order of IPs? In the future I want to add another public IP.

Here are my NAT settings:

 0   chain=dstnat action=dst-nat to-addresses=192.168.1.150 to-ports=3389 protocol=tcp dst-address=XXX.XXX.44.247 
 1   chain=srcnat action=src-nat to-addresses=XXX.XXX.44.247 src-address=192.168.1.150 out-interface=ether1-gateway 
 2   chain=dstnat action=dst-nat to-addresses=192.168.1.254 to-ports=3389 protocol=tcp dst-address=XXX.XXX.44.243 dst-port=3389 
 3   chain=srcnat action=src-nat to-addresses=XXX.XXX.44.243 src-address=192.168.1.254 out-interface=ether1-gateway 
 4   chain=srcnat action=masquerade src-address=192.168.1.0/24 dst-address=192.168.1.150 out-interface=bridge-local 
 5   chain=srcnat action=masquerade src-address=192.168.1.0/24 dst-address=192.168.1.254 out-interface=bridge-local 
 6   ;;; default configuration
     chain=srcnat action=masquerade out-interface=ether1-gateway

Second problem is, that i can’t connect to the PPTP VPN from outside. I think the problem are that multiple public IPs. I use settings for PPTP that I find on the YouTube. Only simple settings.
Can somebody help me to create the rule for firewall?

Thanks for reading, your time and your answers.

2

You have to replace your last NAT rule (the masquerade one) with a src-nat rule like you did for the servers.
/ip firewall nat
add chain=srcnat action=src-nat src-address=192.168.1.0/24 in-interface=bridge-local out-interface=ether1-gateway dst-address!=192.168.1.0/24 to-address=x.x.44.247

3

Hello,

thanks for your reply, but it gave me error:

Couldn't change NAT Rule <192.168.1.0/24->!192.168.1.0/24> - ingoing interface matching not possible in output and postrouting chains (6)

when I edit current masquerade rule or create new one.

What I did wrong?

Thanks

4

I’d suggest to omit the in-interface statement as you’re pretty safe with having the src-address already.
-Chris