Real world addresses and forwarding

RouterOS General
1

Hi all,
We have a range of real world addresses that are supplied to us.
What I want to know is how to put a Mikrotik in front of one of my servers to protect it.
The issue is that the server I want to protect has that real world address.

eg: say I have an Email server registered on the internet with 202.27.184.3
And I want to Give my Email server that address.
Now I don’t want to use Nat here as the email server actually needs the address of 202.27.184.3 because when you look into the smtp you see the address of the server.

So how do I put a Mikrotik in front of it and port forward through to the email server when the email client on the net is trying to talk to 202.27.184.3 and my Email server has the address of 202.27.184.3

So essentually there is no Nat, it is just a port forward rule so that the Mikrotik acts as a firewall to protect the server and only allow the ports I specify.

Hope i have explained this well enough for you to understand what I am trying to say.

2

You’ll want something like this:

/ip address 
add interface=external address=192.0.2.1/24
add interface=server-net address=202.27.184.1/24

/ip firewall filter
add chain=forward action=accept in-interface=external protocol=tcp dst-address=202.27.184.3 dst-port=25 comment="Allow SMTP"
add chain=forward action=accept in-interface=external protocol=tcp dst-address=202.27.184.3 dst-port=110 comment="Allow POP3"
add chain=forward action=accept in-interface=external protocol=tcp dst-address=202.27.184.3 dst-port=143 comment="Allow IMAP"
add chain=forward action=drop in-interface=external comment="Drop all other traffic."

Obviously you’ll need to substitute the interface names, IPs, and allowed ports for the specifics of your network.

3

You could also simply bridge two interfaces and run a bridge firewall, and administrate on a different network on a different port.

4

Thanks guys, that has helped a lot