Questions about Masquerading and NAT rules

RouterOS General
1

I am trying to set up a mikrotik with may different nat and masquerading rules on it. I have a few questions about the ability of the mikrotik here.

First, what are the connection limits of the mikrotik for NAT and Masquerading.

Second, we have blocks of private IPs that need to be masqueraded to multiple public IPs. How is this accomplished?

an example would be that the block of IPs of 192.168.1.0/24 needs
to be masqueraded to X.X.1.0/28 and then 192.168.2.0/24 needs
to be masqueraded to X.X.2.0/28 and so on.

If you put multilple IPs on the interface is there a way to select which ones the masquerade rule will use?

Also we where wondering what the NAT and Masquerading connection timeouts are?

Thanks

2

I believe what you want is Source NAT.
You can source nat an IP or a range of them out to a specific IP on a given iface.

3

We got the SRC-NAT rules up and running now but we are having major problems with users being able to access AIM and Secure Web sites. Anyone have any Ideas as to why that would be?

Thanks

4

which firmware version is in use?
i had similar problems with some pages which turned out to be caused by a particular ISP (traffic shaping)

masqerading means matching many private ip-addresses to one public ip-address.

http://www.mikrotik.com/Documentation/HowTo.html#How_dstnat

; dst-nat:
src-address=10.0.0.0/24 dst-address=192.168.250.0/24 action=nat 

; src-nat:
src-address=192.168.250.0/24 dst-address=10.1.1.0/24 action=nat

should give a one-to-one ip-address-maping, depending on incoming dst- and src-address.

regards.
matthias

5

try:

/ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1-xxx.yyy.1.15
6 
/ip firewall src-nat add src-address=192.168.1.0/24 action=nat to-dst-address=xxx.yyy.1.1-xxx.yyy.1.15

where xxx.yyy is the public part, i’d guess.

will this provide the inbound mapping (dst-nat) automatically?

(these things are poorly documented)

regards.
matthias

7

Yes. That’s right

8

We are running on 2.8.17 code right now but I have a test box with 2.8.19 on it and we are seeing the same behavior.

We have the rules set up as follows.

We are using Mangle to mark the traffic with flow marks.

0 src-address=x.x.128.0/21 in-interface=Border action=passthrough mark-flow=mark1

1 src-address=x.x.136.0/23 in-interface=Border action=passthrough mark-flow=mark1


Then we are using scr-nat to nat the traffic.

out-interface=To 7206 flow=mark1 action=nat to-src-address=y.y.105.214-y.y.105.254


We have many rules similar to the one above for different customers.

there is no traffic shaping on this line other than the limits created by the speed of the links(2 DSL lines).

Thanks

9

why so complicated? (the mangle rules)
(and i would suggest upgrading to 2.8.21)

regards.
matthias

10

is there another way to group the two blocks(x.x.128.0/21 and x.x.136.0/23) together so that they are both NATed to the same block(y.y.105.214 - y.y.105.254) with out using the mangle rule?

And would my current setup cause any problems with logging into applications such AOL Instant Messanger or Secure Web sites? And if so how can I fix this.

Thanks

11

sorry, i haven’t seen this. i think its a good way to handle blocks of ip-addresses.

i will do some NAT tests in the next weeks, as we have a few noncoherent public class-c ip-blocks we’d like to map into internal ip-ranges.

btw, what’s about payload using NAT with mikrotik router os? will e.g. dns requests be handled similar to cisco NAT? i.e. translating dns-data in request but not in zone transfers. this is quite important for using public DNS-servers behind NAT and one reason we still use some cisco routers.

regards,
matthias

12

groups of addresses will be controllable in 2.9, where there is the address list, where you can for example create a blacklist of some kind, and then just have some script enter new IP addresses there. Or you can have any other kind of address list. Wait for 2.9 (it’s in the beta already i think)

13

2.9 seems to become a real improvement! (if i could only install the beta;-)

anything about the NAT’d payload question?

regards,
matthias