Hi All,
I’ve got a RB1100 running 5.12 with a public IP on ether 1, 192.168.71.5/24 on ether 2, and 192.168.88.2/22 on ether 3. Default route points to the public IP, & I have the following firewall rules (no filter or mangle rules):
ip firewall nat print
0 chain=srcnat action=masquerade src-address=192.168.71.0/24
1 chain=srcnat action=masquerade src-address=192.168.88.0/22
The public IP is connected to a proxy server which is seeing private IP ranges coming through. So what am I missing?
Cheers
Steve
your public router ip can see your private and it 's normal , because they are in a 1 router. and so there is no risk.
if you block traffic traffic from public router ip with private network all traffic from private to outside will be blocked.
The upstream proxy is seeing private IP’s coming from the Mikrotik Public IP interface, surely leaking IP addresses like this is bad? i.e
Private LAN 192.168.88.0/22 >> Mikrotik [Public IP 1] >> Proxy [Public IP 2] >> Internet
If you have no filtering on the forward chain then all ports can route to all ports. Try adding some filters on the forward chain. e.g. allow forwarding between the LAN ports (if desired) and drop everything else. Then masquerade on traffic coming from your LAN subnets which is exiting on the public interface.