Select public IP compared to the LAN

Hi everyone ! :slight_smile:

I allow to post on this forum, because I have a small technical problem (of configuration) of my router.

Currently, my router is configured with two LAN, 192.168.10.0/24 and 192.168.88.0/24 (on the bridge). :confused:

My interface WAN, is on the port ether1 and two public IP configured.

How can I make my 192.168.10.0/24 LAN use the first public IP and the 192.168.88.0/24 network go through the second public IP?

Thank you in advance for your invaluable help! :smiley:

Hmm, TWO Public IPs on the SAME WAN. I just hate complications LOL.

We need to know the following facts.
a. how are the two IPs being provided

  • if dynamic IPs expecting different mac addresses - makes life complicated - see SOB
  • if static but expecting diff mac addresses tis not a proper routed subnet (block of IPs approach) - makes life complicated- see SOB.

Quick solution for the above two scenarios!!
ONE CABLE FROM MODEM going into managed switch use one input port and designate on same network, two other switch ports, two cables out from the two switch ports going into ether1 and ether2 into mikrotik!

If Static IPs properly routed subnet
THEN you can assign them statically using the single ethernet interface (modem) direct to router.
Normally there is a block of IPs, like five, where one uses one IP for the router itself and any private LANs that need NAtting
and the other public IPs are used for one to one mapping one public IP direct to a private IP.

Anyway the limitation on those public IPs, how they are assigned will be important to know.

I’ll assume it’s a block of static addresses.

You assign ether1 the block of public static addresses. ie: 200.218.100.0/30

In IP > Firewall > Nat, add a src-nat rule. When packets come from interface of 2nd LAN, then action=src-nat, to-address = 2nd public IP. Move this rule above the masquerade rule, which takes everything else and applies the first IP to it.

Learned something new, i didn’t thing of rule order in Source NAT.
In any case if one was to run with the assumption and to make Sob cry with joy here is my idea of a config

ether1 =wan
ether2 is LAN1
ether 3 is LAN2 (but on on bridge)

Assuming a /29 subnet where 200.1218.100.1 is the gateway IP and using .2, .3 for your static IPs…
add both IPs being used in the /ip addresses tab.

/ip firewall address list
add comment=“Identify First WANIP” address=200.218.100.2 name=ISP1
add comment=“Identify Second WANIP” address=200.218.100.3 name=ISP2

/ip firewall nat
add chain=srcnat in-interface=lan1 action=srcnat to-addresses=200.218.100.2
add chain=srcnat in-interface=bridgename action=srcnat to-addresses=200.218.100.3

/ip firewall filter
{Forward Chain}
drop invalid
accept established, connected, untracked
accept in-interface=LAN1 out-interface-list=ISP1
accept in-interface=bridgename out-interface-list=ISP2
drop all else

That should get you close, what i don’t get is how the above would actually force anybody out any particular WAN?
Perhaps need routing??
/ip routes
???

/ip mangle
add chain=forward in-interface=ether2 action=mark routing new-routing-mark=LAN1_traffic (passthrough not checked)
add chain=forward in-interface=bridgename action=mark routing new-routing-mark=LAN2_traffic (passthrough not checked)

/ip routes
0.0.0.0/0 gateway=210.218.100.1 distance=1 routing-mark=LAN1_traffic pref-source=200.218.100.2
0.0.0.0/0 gateway=210.218.100.1 IP distance=1 routing-mark=LAN2_traffic pref-source=200.218.100.3

You’d still need to add the default route manually, as you’d do if you were only dealing with 1 static IP. In my example I should’ve used a bigger subnet such as /29 which would yield 6 usable addresses. So for 200.218.100.0/29

.0 = the network, can’t use that IP
.1 to .6 = IPs that can be used. Your ISP will use an IP as the gateway, lets say .1
.7 = the broadcast address

If I wanted to uses only 3 of the 6, I’d only add 200.218.100.2/29, 200.218.100.3/29 and 200.218.100.4/29 to IP > Addresses.

So you’d set up your default route of 0.0.0.0/0 to forward through 200.218.100.1

If your ISP gave you two static IPs from two different subnets which consequently means you have two gateways, then your src-nat rules would be the same, you’d add the second static IP to your wan interface and add a second default route. But you have to specify routing marks on your default routes. Your routing marks can be “LAN1” and “LAN2”. Now you have to add two more mangle rules.

  1. When packets come in LAN1, mark the packet with a routing-mark of LAN1.
  2. When packets come in LAN2, mark the packet with a routing-mark of LAN2

Now they’ll go out their corresponding default route.

If a packet does not have a routing mark, it’ll go out the first-in-the-list default route. If a packet originates from the Mikrotik such as a DNS query, it’s src-address will probably be the first IP for the WAN.

As for dynamic IPs assigned by your DHCP, The config is similar but you have to use scripts to update your src-nat and default routes.

First, in the DHCP protocol your DHCP Client defines a client-id. You can set this and have multiple DHCP IPs assigned to one mac. However many DHCP Servers ignore the client-id field, and use the mac address as the client-id. If this is the case, then your interface can only obtain 1 IP and you’d have to use a switch and second interface for WAN2.

Now if you have two different gateways, then your DHCP Client needs to be set to NOT add a default route since routing marks are required and can’t be set in the DHCP Client. You will need scripts to detect your public IP and create/update default routes and src-nat rules with the public IP.