True Routing - Bypassing NAT for certain Static IP Addresses

RouterOS General
1

Hi all.

I have a PPPOE dial up connection to my ISP - with a /29 IP block of addresses.

I want to set internal devices to the individual static IP addresses rather than a NAT'd address.

Is this possible? Could someone outline the basic steps to achieve this please?

I've added the first IP address that is allocated to the router to the internal LAN interface - and I can set the next static IP address on a device using the first IP address (router) as the gateway - and I can access the internet. I can't however access the internal device from outside of the network.

If I add the 2nd IP address to the PPPOE interface - then I lose internet connectivity on the internal device. So I am obviously doing something wrong!

Thanks for reading.

Paul

2

Well isn't that as simple as going to your DHCP server on the router and selecting the device that has an ip allocated and just click "Make static" on the right hand side of winbox (under "Actions").

Or you can do it via the terminal using the command (insert the ip address that u want to make static inside the qoutes in the command)
This finds the ip address 192.168.30.235 in ur dhcp server and makes it static.

/ip/dhcp-server/lease/make-static [find address="192.168.30.235"]

If your ip is wrong or not in ur dhcp server you get an error message:

failure: no items found
3

I have a block of static external ip's though - for example - 47.47.28.160 - 47.47.28.168

My router is assigned 47.47.28.161 as it's IP address on the PPPOE connection.

I want an internal device to be 47.47.28.162

4

You were almost there. The missing parts are to add an accept rule in /ip firewall nat for the public addresses before the default masquerade rule so outbound traffic uses the public address assigned to the device, and to add accept rules in /ip firewall filter before the default 'drop not dstnat from WAN rule' which otherwise catches all inbound traffic to the additional addresses.

If the PPPoE assigned address is part of the /29 you can also use it was the public LAN address so as not to waste an address.

5

Thanks - I will try this and see what happens!

6

What you are probably looking for is the "routed subnet over pppoe" configuration. I'll outline the steps, including the ones you've already done, just for clarity.

  1. Add the x.x.x.161/29 address on the internal interface.
  2. It's best to configure your device (the server) with a static ip address as x.x.x.162/29, gw: x.x.x.161

This should get you internal->external connections, still nat-ed though.

  1. To disable the nat, either add an accept rule for your devices (by in-interface, if you have a separate interface/bridge for the public devives, or src-address) above your masquerade rule or add a negative ("!") matcher to the masquerade rule that excepts these connections.
  2. Add an accept rule directly above the "drop all from wan" rule in filter forward chain with dst-address=x.x.x.160/29