SRC/DST NAT issue - private IP shows on customers CPE not Public.

RouterOS General
1

It’s probably something simple I’m not doing… but I’m still early on in my career so still learning little bits like this!

We have a mikrotik router that has a /28 assigned to it from the ISP. One IP is assigned to the SFP-sfpplus1 interface itself for the bridge Eth1 to 5.

For now we are just connecting one customer to the Mikrotik but we are likely to add connections in the very near future.

The customer needs a public IP to be assigned to their equipment for VPN, SFTP etc.

We’ve assigned eth10 to the customer. I created a subnet of 10.10.10.0/30 on eth10 with the view of doing src/dst NAT for a public IP.

Well say the public IP subnet is 12.13.14.224/28. The public IP I want to give to the customer is 12.13.14.230.

I did the src and dst nat rules as below:

srcnat:
Chain: srcnat
Action: src-nat
Out interface: sfp-sfpplus1
Src-address 10.10.10.2 (eth 10 is assigned 10.10.10.1)
To-address: 12.13.14.230

dstnat:
Chain: dstnat
Action: dst-nat
In interface: sfp-sfpplus1
Src-address 12.13.14.230
To-address: 10.10.10.2

There were no masq rules in place. I could get internet access on eth10, but was getting 10.10.10.2 showing as the WAN IP on the customers CPE. I just can’t figure out how I can get the Public IP to show. It shows up as the Public IP on Speedtest.net though so I must be doing something right…

I should also add that 12.13.14.230 is in the address list on SFP-sfpplus1. Route of 12.13.14.224/28 also exists.

Thank you!!

2

If you give them the address 10.10.10.2/30 then that is what their router sees as the WAN address, they have no direct visibility of any NAT you perform.

There are various solutions:
Have your WAN and the customer port bridged, assign them the address 12.13.14.230/28 and the ISP gateway, use the bridge use-ip-firewall=yes setting so you can apply firewall rules and queues to their traffic.
Use PPPoE instead of IPoE, enable proxy ARP on your WAN interface.
Use a /30 or /31 (if their router supports it) chunk of your subnet on the link between you and their router (wastes some of your public IPs), enable proxy ARP on your WAN interface.
Stick with the private address range on the link between you and their router, add a route for 12.13.14.230/32 via 10.10.10.2, they have to add the public address as an alias and originate traffic with this address rather than the private transit one.