Newbie needs help with masquerade!!!

RouterOS General
1

Hi guys.

I am very new to the mikrotik scene, and need some help to get masquerade working.

I need to hide one network from another using a RB750 as a bridge between the 2. The one network has the following range: 172.32.8.0/22. This is my operational network.

The other network is on the 10.184.0.0/16 range. I need to be able to access resources on the 10.X network, while the users on that network must not be able to see the 172.X network.

I heard that the masquerade function might be what I need to use. I have not had any luck to set this up using winbox.

Please help!!!

2

I think this is more a filter function.

/ip firewall filter
add chain=forward action=drop src-address=10.184.0.0/16 dst-address=172.32.0.0/16 connection-state=new
3

I do not want to drop the packets from the 10.184.0.0/16 network, due to the fact that some of the user’s might need to use DHCP from that network in order to make use of some of the in-house apps that require a 10.184.x.x IP.

I purely need to hide my 172.32.8.0/22 from the 10.184.0.0/16 network using some form of NAT.

4

That rule only drops new connections from the 10.184.x.x net to the 172.32.x.x net. The 10.184 net can go everywhere else. The 172.132.x.x net can still ‘see’ the 10.184.x.x net.

But if you insist:

/ip firewall nat
add chain=srcnat action=masquerade src-address=172.32.8.0/22

ADD: That is about as close as I can come, and I don’t think that will work. ??

5

SurferTim’s first rule is what you asked for and want. It is only dropping connections made from 10.184.0.0/16 to 172.32.8.0/22, and no other traffic from 10.184.0.0/16.

The NAT rule only “hides” the 172.32.8.0/22 IP address that is connecting to the other subnet. It does nothing to prevent 10.184.0.0/16 from “seeing” or connecting to 172.32.8.0/22.

6

Can’t you just configure the router with a standard NAT masquerade, using the 172.32.8.0/22 network as the LAN side and the 10.184.0.0/16 as the WAN side?

7

That is exactly what I want to do. I want to hide the 172.32.8.0/22 network behind one ip address on the RB750.

I do not want to prevent any new connections from taking place though. That is why I thought masquerade might do the trick.

I will try the filter rule, you might just be spot on.

8

You’re contradicting yourself. Are you trying to prevent new connections from being established? Then you need filter rules. Do you need to translate IP addresses while permitting new connections? Then you need NAT. The two goals you’re stating in one post are mutually exclusive.

9

Sorry for the confusion. :laughing:

I need to be able to allow new connections, but translate the addresses.

10

Assuming these networks aren’t actually bridged but routed (they have different layer 3 addressing, after all), SurferTim already posted the right generic solution:

/ip firewall nat
add chain=srcnat action=masquerade src-address=172.32.8.0/22

It’s impossible to be more specific without knowing interface names.