I’ve posted this question on the scripting forum a few days ago but that place seems to have such a low amount of traffic I might as well try it here also.
Referring to the last example on this manual page, http://www.mikrotik.com/docs/ros/2.9/ip/route, I only need to write a masquerade (SNAT) and a routing mark rule to get a computer with a private IP behind the router connected to the outside. How come I don’t need a matching pair of rules to cater for the incoming packets as well? Under what circumstances would I NOT need to cater for the returning traffic?
Not sure about your routing mark comment.
If your requirement is just to NAT (masquerade) private ip addresses behind your RouterOS machine, you only need a masquerading rule (source-nat).
The router is keeping a table of src-natted connections so it can do the reverse mapping (of incoming response packets) without further config. That’s the way all standard masquerading devices work.
I have a question about this masquerade thing to: here is my setup
CISCO 1721 FROM T1 CARRIER
12.x.x.x have 127 usable ip’s
Two Ethernet Cards in the mikrotik, I want to beable to use Port FOrwording for some CUstomer that need a server on the public side, What i have a problem with is i want to also keep masquerade on my .125 address or whatever one i tell it to use and the use the other address for the customers who need public ip’s. I can get it to masquerade but i dont know how to specify the .125 to use that and not the other address that i add to the Router? pls Help
jhydzik, if you have a new problem please start a new thread.
cmit, thanks for the answer. My routing mark comment was there because I’ve two ADSL lines going out of the office but yes, I looked back at it and it really had nothing to do with my problem. Regarding your answer, would you say the following statement is correct?
I should simply write a NAT rule for who ever that starts a connection. (Without going into the technical specifics like connectionless protocols and such)