Nat of indirectly connected network

RouterOS General
1

Example:
Client device (172.16.0.2/24) → (172.16.0.1/24) Mikrotik router without nat (192.168.0.2/24) → (192.168.0.1/24) Mikrotik router with NAT (Any globally routed address) → Internet
on client device default router is 172.16.0.1
on Mikrotik rouer without nat default router is 192.168.0.1
Is it possible to make a Mikrotik router with NAT to nat client’s device subnet (172.16.0.0/24) to the internet
FreeBSD PF can do this. Does Mikrotik able?

All routing if fine. Nat rules present.

I can make nat of 192.168.0.0/24 subnet from my example on Mikrotik router with nat easily. How to do this for 172.16.0.0/24?

I need masquerade for dynamic IPs.

2

Yes, you just need the correct routing & NAT rules in place.

Assuming ‘Mikrotik router without nat’ has a default route to 192.168.0.1, then on ‘Mikrotik router with NAT’ you need a static route for 172.16.0.0/24 to 192.168.0.2 and a suitable NAT rule, the one in Mikrotik default configuration applies NAT to all forward traffic leaving via the WAN interface.

3

Routing is fine, nat rule exists. Unfortunately, it doesn’t work. Are you able to test it with 2 devices or in chr environment?

4

Default SRC-NAT rule

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN

should be able to properly NAT anything going out via WAN interface regardless the src-address.

If you want to get some concrete advice, post text export of main router’s configuration (execute /export hide-sensitive file=anynameyouwish in terminal, fetch resulting file, open it in text editor, obfuscate any remaining sensitive information such as public IP address or serial number, and copy-paste result inside [__code] [/code] environment).

5
  1. make sure you can ping the 192.168.0.1 from client device (172.16.0.2)
  2. make sure your traceroute to internet (ex. 8.8.8.:sunglasses: go through 192.168.0.1
  3. add NAT on 192.168.0.1 router

/ip firewall nat add action=masquerade chain=srcnat out-interface= src-address=172.16.0.0/24

6

This is exactly what was done. And it is doesn’t work. I am going to put my config here later.