Hello everybody
I setup hotspot gateway with mikrotik ver 4.11 and its work fine with masquerade local IP.
I want to NAT one server and see it through the internet
here is my configuration
Those rules look OK, though just to check: you have a DMZ/third network for 192.168.2.2? Your LAN is otherwise referred to as 10.6.10.0. Also, is .30 an IP address implemented on a router interface?
If you can please post a network diagram.
But given that the IPs are correct those rules are correct. That you can’t ping could be due to any number of reasons, in order of likelihood the most common ones are: a host firewall on 192.168.2.2 blocks ICMP (recent Windows versions introduce the concept of zones, where the local network can ping the host, but remote networks cannot), you have firewall rules on the router that block ICMP (post the output of to get help troubleshooting that), and your ISP is dropping ICMP and there’s nothing you can do about (can be disproven by pinging the router WAN interface).
You initial post mentions x.x.x.30, your diagram shows x.x.x.89. Any IP address that you NAT to must be implemented on a router interface - otherwise the directly connected router trying to forward traffic tries to ARP for that IP, doesn’t get a response from your router, and discards the packet since it doesn’t know where to send it. Do you have x.x.x.30 on an interface on the Mikrotik router? An alternative is proxy ARP, which is a fairly ugly solution and would only work if you own the ENTIRE subnet connected on the WAN router interface, with the only exception being the ISP router’s IP address.
If you need further help, please post the output of “/ip address print detail”, “/ip route print detail”, “/interface print”, and “/ip firewall export”.
Read my post - you need to add .30 as an additional IP to your WAN interface.
When traffic goes to .30 on the ISP router it needs to know where to send it. It’s a multiaccess Ethernet interface so it’s going to ARP for that IP. Unless your router responds to the ARP request for .30 the ISP router will not be able to resolve to a MAC address, and will not send the packet. In your situation the only way to get your router to answer ARP requests for .30 is to implement that IP on your WAN interface.
It would also be best practice to move the specific destination and source NAT rules for 192.168.2.2 above any other source NAT and destination NAT rules. You don’t have any that interfere right now, but might in the future. NAT rules are evaluated in order, so you should list the most specific first.
