I have an isp router with 192.168.2.0/24 and a pc connected on isp router with 192.168.2.200
i have also a mikrotik with 192.168.80.0/24 as vpn client on my mikrotik vpn server. i also remotely can ping the specific pc.
My question is , can i change ip adress to listen for example 192.168.2.200 on 192.168.80.250 because i need to do these on 10 different places and all have the same provider and the same dhcp server from isp and need to redirect ip of specific pc to another ip of mikrotik dhcp range.
Sorry, you’ll have to express the setup and issue using a drawing (a photo of a hand-drawn sketch is normally enough) as it is not really clear (at least to me) what the issue is.
I did understand that you’ve got multiple sites where the ISP modem provides the same LAN subnet, and I assume I have understood properly that there is a Mikrotik on each such site that connects as a VPN client to some central site. But what next? Do you need to use these VPN connections to access devices with the same address (192.168.2.200) on each of the sites? If so, from where do you need to access them? From the central site of from any of the remote ones?
correct need access from central to each site same ip adress
Unless you use bare IPsec, the following rule in the dstnat chain of /ip firewall nat should be sufficient:
chain=dstnat in-interface=name-of-the-vpn-interface protocol=xyz port=xyz action=dst-nat to-addresses=192.168.2.200
But that rule alone does not address the need that the PC has to send the response via the Mikrotik rather than via the ISP router, so you either have to set a route to the address of the client on the PC or to use a masquerade rule that will make the request look as if the Mikrotik itself has sent it, which will prevent the PC from seeing the actual address of the client.
If you need to access more than a single address/port on the PC, you can place action=accept rules before (above) the action=dst-nat one that will match on the management protocol and port you use to manage the Mikrotik itself, and remove the matching on protocol and dst-port from the action=dst-nat rule.
so you mean that after these i can access pc with rdp using the remote adress of vpn client and not 192.168.2.200 right?
→
???
right ![]()
i do something wrong . is there possible to help via teamviewer-anydesk?
In an hour at the earliest. If you don’t want to reveal your contact information publicly, you can use the method described here.