I wonder if someone could point us in the right direction.
We are wanting to configure a Mikrotik RB493 to take full advantage of the /29 block that our ISP have provided us.
Please refer to the attached diagram.
I have configured a basic router setup to Lan1, but we would like to feed other remote sites via wireless bridges… eg Lan2 & Lan3 etc.
(The RB493 has 3 radio cards installed.)
We would like to be able to connect to each individual network with their own public IP address.
We also need to be able to NAT a number of ports in and out of each of the LANs.
I feel it should be possible to do this with the RB493 …
but I have some question marks on the diagram and would appreciate comments about what I need to configure.
If I’m understanding what you are wanting to do based off of your diagram, you would like a separate subnet on each of your LAN ports, and each LAN getting a NAT’ed out of a different public IP. This is easy to do.
1.) Set up a different private subnet on each interface that you want to act as a LAN, along with any other services you want to offer over that interface such as DHCP server.
2.) Set up the appropriate NAT rules, since you have a static block of IP addresses you can use a src-nat rule with action=src-nat and specify what IP address you want to use for the subnet.
You are also probably going to want to set up a few firewall filters to prevent one subnet from talking to another.
If you are looking to directly feed public IP addresses to a remote location and have them assigned to a device that is local to that, you can try bridging your WAN port with the WLAN cards to make them act like they are on layer two. Instead of having your public IP addresses for the local LAN on your current WAN port, you would move them over to the bridge, so traffic from the local LAN would then get NAT’ed out of the bridge instead. This should work, but I’m not sure how it may affect the wireless links. You can set up this bridge to use the IP Firewall and try and restrict what ports traffic can go out of from with the firewall to address this.
