Netmap vs. Src-nat

RouterOS Beginner Basics
1

We have 5 valid IP addresses, which are being setup from ISP in our office, and my clients have access to Internet using these addresses, the point is i don’t exactly know what is the difference between Net-map and Src-nat and masquerade in NAT, as far as i know all map private IP to public IP, but which one to use and when to use? ( for now all clients are being masqueraded and everything looks fine ).

2

Have you need to reach services from outside (Internet) that are available within your LAN?

3

yes sure we have 2 web server and ftp server, our services must be visible to public…

4

Ok,
when you use the Netmap mode you open all ports and protocols from a public IP to a IP of your internal network like a DMZ.
ex from Wiki:

/ip firewall nat add chain=dstnat dst-address=11.11.11.0/24 \
	action=netmap to-addresses=2.2.2.0/24
/ip firewall nat add chain=srcnat src-address=2.2.2.0/24 \
	action=netmap to-addresses=11.11.11.0/24

When you use dst-nat you can define only ports and protocols that must be used:

/ip firewall nat add chain=dstnat dst-address=YourPublicIP action=dst-nat to-addresses=YourLANIP

something like:

/ip firewall nat add chain=dstnat action=dst-nat to-addresses=YourLANIP to-ports=21 protocol=tcp dst-address=YourPublicIP dst-port=21 log=no log-prefix="" comment="dst-nat FTP service"

Please read the wiki’s page:
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

5

thx
you know, i now can get the point about what you said, but in WIKI i read these and i cant figure out the difference :

netmap - creates a static 1:1 mapping of one set of IP addresses to another one. Often used to distribute public IP addresses to hosts on private networks
src-nat - replaces source address of an IP packet to values specified by to-addresses and to-ports parameters

so what is the difference between these two? both have to-addresses and to-ports field !!

6

Please read the difference between source NAT and destination NAT.

If your goal is to open services from a public network to a private destination you will need to use destination NAT.