We have PCC set up and working wonderfully on a RB493AH. Incoming bandwidth is ether3, 4, and 5, ether1 is LAN, and we have a pool of Live IPs on ether2 that we’d like to offer customers by netmapping them to the customer’s private IP. Currently we have the APs that have customers that need a live IP bridged so that they can pass through, but we’re aiming towards removing bridging everywhere.
When I add one of the live IPs to ether2 I can ping it, see the router on it, and everything’s good. If I add a dstnat rule to netmap to a private IP and enable it, I can no longer ping the IP, but the odd thing is that once I disable that rule I am still unable to ping the IP. Yesterday I had it working, but am unsure what changed.
If any config is needed, please let me know and I’ll post it ASAP.
Yup, config is needed. Post the output of “/ip address print detail”, “/ip route print detail”, “/interface print detail”, “/ip firewall export”, and an accurate network diagram.
I’ll add a diagram on the next post. I’ve removed the filter rules as while I’m testing this I disable when testing the netmapping, and once I have a working solution I’ll re-enable them one by one, so at this stage they’re not a hindrance.
The rules for the netmapping are currently disabled, as are the attempted mangles to get them to bypass the PCC. Thanks in advance for any assistance.
Any IP address that you destination NAT must initially belong to the router so that upstream routers know where to send traffic. You either need to turn on proxy ARP on the WAN interfaces (only do this is the entire subnet is yours! You would interfere with others users on the same WAN network if it’s shared, and would get turned off by your ISP very quickly), or implement each IP address as an IP address on the WAN interface.
If the upstream router can’t ARP for the public IP it doesn’t know where to send traffic, and drops the packet.
I was testing with multiple, removed the wrong one. It’s fixed above. The IPs that will be NATed will be assigned to ether2.
The /26 is ours, so I need to set ether2 to proxy-arp? I’ve seen that for setting up PPTP, but never for dstnatting.
Note on the diagram below - the backhauls are just bridges, APs are set to route. The config above has the routes to the APs removed as that part works fine and it’d just be extraneous information.
The /26 is ours, so I need to set ether2 to proxy-arp? I’ve seen that for setting up PPTP, but never for dstnatting.
Yup. Or add an IP address for every single address in that /26 to ether2.
The problem isn’t destination NAT, the problem is that the router on the other end doesn’t know where to send traffic to IPs in that /26. It ARPs for the IP address before sending to it, and nothing is responding - so it doesn’t know where to send stuff on layer 2. Just basic TCP/IP over Ethernet. Enabling proxy ARP or implementing all those IPs on the router interface will cause your router to respond to ARP requests for IPs in the /26, the upstream router will know where to send traffic, send the packet to you, and you then NAT it.
I think we crossed meanings earlier. The plan is for us to add the Live to ether2 for each one that we’re dstnatting - the client that will be on the receiving end of said Live will have a Private assigned to them, the only place the lives will -actually- show up is on the router that I posted config for.
What I’m having trouble with is getting the dstnat to work in conjunction with the PCC rules.
Oh, I see. So you just need to expand your config for policy routing, to punt everything that came in via ether2 back out ether2, as well as route those guys out ether2 in general? Easily done, just confirming I’m understanding it right this time.
Yes. Traffic comes in on ether2 to address X (one of the lives) and goes to Y (a private), traffic comes into ether1 from Y and goes out as X. With ether2 having multiple Lives mapped to different privates.
Having regular traffic from the privates that have an associated live go out one of the normal pipes wouldn’t be an issue, as what we’re most concerning about is incoming traffic being able to get to them, but a full 1:1 would be nice.
That marks all traffic from IPs on the address list to go via ether2, before PCC is applied. Then add a route for that routing mark (‘to_ether2’) in your routing table, just like you did for the PCC rules. That should do the trick.
