NAT 1:1 multiply IPs

RouterOS General
1

I have such a scenario. I need to forward several IPs. Easy?! I thought it.
I have main gw with 42/29 IP and I need to forward 43-46 IPs to another Mikrotik(MT1 with NAT) in the LAN. Unfortunalety all clients are connected via eth2 port via another Zyxel switch so I cant use bridge (WAN+LAN(MT1), so I cant routed /29 directly to MT1.
How can I forward all public IPs directly to MT1?

  1. I can add another IPs (43/29…46/29) to my WAN port and used netmap but this is semi-solving, there is a several problems
  • Clients behind MT1 will have 42 IP as their source IP. Ok I can make double src-nat (MT1 lan IP---->46/29 e.g) but this can be user only for one public IP. MT1s clients cant have own public IP
  • Public IPs are in my MT, not in the MT1

How can I di this scenario better? The best case would be if MT was connected to separate port and I can use bridge this port with wan a then all public IPs are routed to MT1, but I have only one port with many LAN clients.

What I want…forward all free public IPs to MT1 and then admin of MT1 will decide which of his client get one. And then the client will has this public IP as his source IP in packet header.

2

There are multiple possibilities. The simplest one should be to create a WAN+LAN bridge as you considered but make the physical WAN port an access port for VLAN X and ether 2 a hybrid port where VLAN X (the WAN one) would be tagged and VLAN Y (the LAN one) tagless. On MT1, the same would be set. Unmanaged switches typically do forward VLAN-tagged frames wihount any issues. So I’d say try this first and come back if it doesn’t work.

The next possibilities are to make an L2 tunnel (EoIP) from the “main gw” to MT1, or to do a double nat - in dstnat on the “main gw”, you would netmap the incoming connections to e.g. 10.0.0.43..10.0.0.46 and on MT1 you would netmap them back, and the same with srcnat for outgoing connections. Just remember than in this case, you have to put the public IPs up also on the main gw to make it respond to ARP requests for these addresses coming from the ISP’s router at .41.

3

Or just route the ones you like to:

/ip arp
add address=x.x.x.43 interface=WAN@MT published=yes
...
add address=x.x.x.46 interface=WAN@MT published=yes
/ip route
add dst-address=x.x.x.43 gateway=y.y.y.y
...
add dst-address=x.x.x.46 gateway=y.y.y.y

(y.y.y.y = MT1)