My ISP gives me multiple public IP addresses and I need to configure a gateway for my mail server that does not effect the rest of the network.
The problem I have is that when adding a second gateway with a routing mark (matching the mail server) the second Interface, my default “reachable interface” cant be manually set. Thus the mail routes via the wrong interface.
The problem is that both my outgoing interfaces have the same default gateway (the gateway of the router). Thus the routes pick the “reachable interface” automatically and I cant force the mail’s gateway via the second interface.
It would seem that the default interface selected as the “reachable interface” is selected when I activate the interfaces. Thus which ever interface in activated last is chosen and I cant seem to find a way to “lock it down” so to speak.
Well I have a router from the ISP acting as the gateway with public ip let say … 41.222.222.1
and I have two interfaces from the Mikrotik Router using this gateway with Public IP’s 41.222.222.2 and 41.222.222.3 and as such they both have a gateway of 41.222.222.1
The reason is that I want mail traffic on the one interface public IP and everything else on the other interface. Thus traffic … say spam for example from an infected pc on the network … wont get the mail server RBL listed.
I am pretty sure you need to put both ips on the same interface then use a combination of mangle rules and a srcnat rule to show mail traffic coming from the other ip. I am a bit a of novice on this I am sure someone with more knowledge than me can give you the correct rules to put in.
it is better i think to put some firewall rules in to detect and prevent spamming in the first place. I seem to remember there are some good examples of this on this forum somewhere.
I also have a SMTP server whitelist and drop all others on my network. Basically my users either use my own SMTP server or they have to sign a declaration of non spamming and I whitelist thier preferred server
Keep in mind that you have do add the routes through the CLI and do not edit them with winbox or webfig. It will wipe out the interface information that you want to keep for the specific route.
/ip firewall nat
add chain=srcnat action=src-nat to-address=<SMTP IP> protocol=tcp dst-port=25 out-interface=ether1 comment="NAT SMTP Server out a different IP"
add chain=srcnat action=src-nat to-address=<MAIN IP> out-interface=ether1 comment="NAT everything else out the main IP"
Be sure both IPs are assigned to the WAN of the router.
