Two ADSL connection connected to MT - Need 1-2-1 NAT

RouterOS General
1

Hello,

Mebbe this question might be answered elsewhere, but I wasnt able to search it in the forum.

Here is my scenario.

I got two ADSL modems each delivering static IP, the internal LAN interface on each of these ADSL modem connected on seperate NIC to MT.
ADSL1 delivers static IP over PPPoE and ADSL2 modem is configured with static IP without PPPoE
MT has three NIC

ADSL1 is configured in such a way that MT makes the PPPoE dialout using the ADSL1 mode and gets static IP : 59.x.x.x
ADSL2 is configured in such a way that it understands MT IP as DMZ and hence all packets coming on public IP : 123.x.x.x lands on MT.

MT NIC configs:

NIC 1 → ADSL1 PPPoE (192.168.0.5 LAN to modem and 59.x.x.x PPPoE static IP)
NIC 2 → ADSL2 192.168.2.2/24 → default gw 192.168.2.1 (ADSL2 Modem IP)
NIC 3 → Local LAN (192.168.1.1/24)

Now I want to run a DMZ Server (i.e. full 1-2-1 NAT on all ports in my local lan - 192.168.1.61)

I want ADSL2 Public IP 123.x.x.x forward 1-2-1 to 192.168.1.61 in my local LAN.

I tried the following :

chain=dstnat action=dst-nat to-addresses=192.168.1.61 to-ports=0-65535
dst-address=123.252.144.92

chain=srcnat action=src-nat to-addresses=123.252.144.92 to-ports=0-65535
src-address=192.168.1.61

also tried with

chain=dstnat action=dst-nat to-addresses=192.168.1.61 to-ports=0-65535
dst-address=192.168.2.1

chain=srcnat action=src-nat to-addresses=192.168.2.1 to-ports=0-65535
src-address=192.168.1.61

but this doesnt work.

Anyone can help me.

Mitul Limbani

2

Two problems here:

1: NAT

Inbound traffic on ADSL2 will have a destination address of 192.168.2.2 when it gets to the MT. Therefore the NAT rules should look like:

chain=dstnat action=dst-nat to-addresses=192.168.1.61 to-ports=0-65535 
dst-address=192.168.2.2
chain=srcnat action=src-nat to-addresses=192.168.2.2 to-ports=0-65535 
src-address=192.168.1.61 out-interface=ADSL2

2: Routing

You need to ensure that traffic that’s originated on ADSL2 gets sent back out through the same interface. You can do this with policy routing.

Regards

Andrew