Netmapping Question

RouterOS General
1

Tried to setup netmapping in RB1000 running v.4.8

Firewall Nat: public = yy.yy.yy.yyy/24 while local = xx.xx.xx.xxx/24

/ip firewall nat add chain=dstnat dst-address=yy.yy.yy.yyy/24 action=netmap to-addresses=xx.xx.xx.xxx/24

/ip firewall nat add chain=srcnat src-address=xx.xx.xx.xxx/24 action=netmap to-addresses=yy.yy.yy.yyy/24

It is not working. I see in torch on the public interface traffic coming back with some different IP numbers belonging to public net. So translation outgoing is made. But on incoming something must go wrong. Browsing is not taking place… :frowning:

Same router works fine when src-nat with action masquerade is set at public interface.

Test PC is three routers away from this routerboard. But default route in PC and next routers is OK (or no browsing with masq. in gateway would be possible) while route back from rb1000 to PC network is working too.

Only complication is that apart from this netmapping in the NAT table I have some other local networks performing masquerade process. But these rules come behind (lower) then the netmapping rules and should therefore not have implications?

Second Question:
If netmapping works, is the translation supposed to be 1:1 and fixed? So a local address with IP xx.xx.xx.1 always get public IP xx.xx.xx.1? And .2 get .2, .3 get .3 etc. etc.? Or is translation taking place at random?
But .2 actually belongs to public interface of router.
On local side interface has .1 but any other device can have .2 as last digit.
How is this managed? Or do I have to setup network such that all digits knocking at local interface always have address ending with different digit and also not the same as existing fixed end digits on public side?

I have presently several different networks all knocking at same local door where now masquerade takes care of translation. Do I now first have to arrange all these addresses coming in from same network and make each last digit unique?

Is my conclusion now right that netmapping (and also “same”) would only work when on both ends of firewall only one same size network is present?
So combination of both netmapping and src nat or masquerade is not possible?

I have several remote networks that all have their own network with even different subnets. Clients knock at local door with different network/subnet range IP´s. How to change that?
Bridging whole network to create one network for all clients is impossible due size, amount of remote routers and remote networks and thus lack of addresses. (If I have to ´cut´ /24 network in /29 subnets I have enough networks (32) but not enough IP’s (180) any more. /28 is not giving enough networks any more.
Bridging also slows network down to much due the broadcast and troubleshooting becomes very complicated.

Do I have to set-up some sort of tunnels to clients so they all have their tunnels ending in this router where authentication server can take care of IP assignment (all within same subnet)?

What tunnels are preferred? Too many options in ROS; VPLS, EoIP, IPIP, L2TP, PPPoE, PPTP, VLAN.
Any advice? (Only fixed located clients that can always be ´on´.)

Some help is appreciated.

2

so many questions… %)

yes, netmap works 1:1. if you use masquerade, does it masq to one of the yy.yy.yy.yyy/24 addresses?.. I mean, do those addresses really work?

p.s. ‘some’ do not need the same network size - it should work with any ‘to-addresses=’ range

3

and so little answers… :frowning:

yes, netmap works 1:1. if you use masquerade, does it masq to one of the yy.yy.yy.yyy/24 addresses?.. I mean, do those addresses really work?

Well, masq gives outgoing traffic the IP of the leaving interface. Interface can only have one address in same network. This is such simple answer to your question that I expect you to know. So I am worried now I migth not understand your question? :confused:

4

for example, we have /29 public network on the interface - for the interconnectivity with our ISP. /24 we advertize via BGP, but addresses from this subnet do not exist on the router =) so if we masquerade, we use 100%-working ISP /29 subnet. but it has nothing to do with /24 addresses :wink: that’s why I asked…

5

Ok, I see.
Well, it actually raise another more or less interesting questions: If we would put two different IP’s on interface, while that interface is masqueraded. What IP will the outgoing traffic get?
Maybe at random, or maybe router crashes, who knows.

Question is not that stupid as it looks like. I can understand temporarily for testing, or access on the desk, you give an interface an IP while that interface in the network will have another IP (fixed, dhcp, or even PPOE in case of ISP!). I you now forgot to remove or disable temporarily IP things might go weird.

6

well, I suspect that ‘masquerade’ uses ‘Pref. Source’ from the route that was used during routing decision

7

ehh, yes I agree. The Ip of the outgoing interface for outgoing traffic will have a gateway IP within the same network. Thus valid outgoing traffic to that gateway will indeed get masqueraded to IP that is part of the gateway network.
So masq. must take it indeed for pref. src. Good thinking. :smiley:

8

i think pref src isnt used since 3.x kernel changes and it just uses the lowest numbered IP on that interface.

9

hmmmm, if that would be the case than things do might go wrong! I have to test that tonight during quiet hours…

10

Do you have all of the IPs that you can you on the public side assigned to the Mikrotik? Without them the scr-nat or dst-nat won’t be able to do anything since it doesn’t know it can route out that IP or respond on that IP.

11

If you have two IP assigned to router’s public interface then for each IP with a subnet bigger then /30 the router creates automatically a route into that network via that IP.
If now masq. takes lowest IP as address to give to outgoing packages, while that IP is not in the same network as any ´real´ next hop (ISP) gateway, nothing happens anymore.

Lets say I use 10.10.10.1/24 on public interface for testing and setup at office table.
Then I set same interface to 89.72.45.2/24 on same interface because that is the IP I can use from the ISP to connect to them.
NowI just forget to remove the 10.10.10.1/24 address when config was finished and walk to my central office to hook up new ISP network..
I had set up masq. rule for all outgoing traffic from my local network to the internet. thus now all these packages get masqueraded into 10.10.10.1 since this is the lowest address. But since uptill now I never realised what happens I haven’t got a clue about the problem but connectivity is zero…

Haven’t tested it yet, it is playing only and I have other things to do…