Subject says exactly what I’m trying to do, though natting it doesn’t seem to be the answer. If i specify a singular IP and test if the port is open, it works no problem. If I create a second rule for the same port(s) to a different IP it doesn’t work, probably because I’ve already natted it to the first IP.
So how would I go about port forwarding 3 specific IP’s?
Namely 10.10.0.221, 10.10.0.253, 10.2.0.2
If someone could just point me in the right direction it would be muchly appreciated.
Are you wanting to access a single IP (dst-address) and forward a single port (dst-port) to multiple internal IPs (to-addresses)? If so, that’s not possible. You could forward multiple dst-address’ to different to-addresses, or different dst-ports to separate to-addresses. ie:
you need to use nth rules or random rules to allow some connections to fall thru to the other rules below the first one. you will find random isnt all that random really.
You should also be able to use PCC in prerouting to mark connections to be spread load evenly across several inside servers, and then NAT based on the connection mark. Something along the lines of:
Thanks to all for your input, I tried the simple natting but like I said the first rule works, the rest don’t. I then tried the mangle, didn’t pan out either. But then instead of creating the mangle with PCC I created the NAT with PCC and it seems to be working… Only possible issue is the ports I need to open: 1500-28960 Some are TCP and others are UDP so I created the same rule for both and testing any port within the range no matter in which order it is under NAT shows good
Did you ever get this to work? I’m having the same issue. Simply adding the dst-address of the alternate public-ip doesn’t work. It seems like it should, however I’m not sure what’s happening.
I am trying to replace an Endian firewall box with my Routerboard 750G but until I can get my multiple public IPs to work (I have two 5 IP subnets) I will be unable to use it.
Post what you got, and what you’re trying to do, in as much detail as you can. A quick guess is that you did not assign all the IP addresses you are destination NATing to an interface. You either need to do that, or enable proxy ARP - otherwise the router at the other end can’t ARP for your MAC address on that IP, and won’t send traffic your way. Overloading IPs from the same subnet is MUCH cleaner than proxy ARP. But if that doesn’t do it, as said, post lots of details.
I have two /29 subnets. Right now I’m just trying to get two IPs from the first subnet working.
For example sake I’m going to use the subnet 198.2.2.8/29
I have both IPs (198.2.2.9 and 198.2.2.10) assigned to the WAN interface (port 5)
I have a cisco T1 router on 198.2.2.13 which is the MT default gateway
That looks OK so far. Please post the output of “/interface print detail”, “/ip address print detail”, “/ip route print detail”, and “/ip firewall export”. Please wrap output in
That should work fine. It’s a pretty straight forward configuration - there aren’t many places things can go wrong, and you configured everything correctly.
Are you 100% sure that the hosts are configured right? Correct gateways on them? Host routes would take return traffic back through that router? If it’s Vista, 7, or 2k8 or 2k8r2 the host firewalls have that pesky concept of zones where RDP might work for local or domain traffic but not for public zone traffic so that local tests work but access from the WAN does not. How are you testing, and where from?
I know, stupid questions, but if I had a penny for every time I overlooked something like that I wouldn’t have to get up and go to work tomorrow…
Well this is an existing setup where an Endian firewall is in place already with same IPs configured. I’m simply putting the routerboard in it’s place. In order to test I am connecting via remote desktop to another network outside and attempting to remote desktop back into 198.2.2.9 and 198.2.2.10. .9 works and .10 doesn’t.
The hosts are XP so none of the vista/7 crap.
The only thing I noticed is that I’m on 4.11 and that seems rather old compared to what is available. I would think it still should work.
-Rich
Absolutely could be. It’s the same fundamental reason you need to assign both IPs to an interface or use proxy ARP to make this work - without the upstream router being able to send traffic to you on layer 2 of course nothing else works further downstream.
It’s more or less bound to be something fundamental like that. Your configuration is correct, and it’s very simple and easy to verify as correct. This is HIGHLY unlikely to be a bug. RouterOS is built on Linux, and MT doesn’t change the kernel. Literally millions of people worldwide are using iptables destination NAT. There are no fundamental bugs like “it just doesn’t work in a completely standard deployment” in that code.
Glad it’s working.
I guess another option would have been to source a ping to the gateway. The ARP table likely never updated because that secondary IP isn’t the preferred source on the interface, so traffic was never sent out with that source address.
