NAT Log

RouterOS Beginner Basics
1

Hello,
I am Jahid from Bangladesh,
I am using a Mikrotik-1036 router for an AP and want to monitor the NAT log.
here I am using a private IP block for LAN & a public IP for wan site and done both net-map with /29 IP block & sometime masqueraded NAT with the single IP.
and now need to log analysis but it cannot show proper log. Please check a simple log:
Oct 14 10:44:45 222.203.42.32 nat: nat srcnat: in:(none) out:ether7, src-mac 00:04:56:b8:c4:3a, proto TCP (SYN), 172.16.0.252:40675->52.77.187.56:443, len 60

But this log is not proper because the public IP is not showing in the log with which through all the private IP was NAT.
please help me

Thanks
Md Jahid

2

I do use Splunk to analyse all logs including firewall and NAT.
Se here for more info: http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-3-3-graphing-everything/121810/1

Your nat log do contain all you need:

Oct 14 10:44:45 222.203.42.32 nat: nat srcnat: in:(none) out:ether7, src-mac 00:04:56:b8:c4:3a, proto TCP (SYN), 172.16.0.252:40675->52.77.187.56:443, len 60

protocol: TCP
local_ip:172.16.0.252
public_ip (dest_ip): 52.77.187.56
dest_port:443
outside_if: ether7

If you by public IP mean your outside IP, you can find it by looking at what IP is assign to ether7
But why do you need that? Do you have multiple public outside IP?

3

Thank you very much for your replay,

I want something more specific , like my LAN IP is-192.168.0.1/20 and wan IP is-100.0.x.x/27 and I do net-map with this IP
is this is possible to monitor each private IP that is NAT with a public IP using syslog.

//thanks
Jahid Hassan

4

I think you should get it if you log the main NAT rule.

5

Thankx to all of your response.
I found it and worked successfully.