Hello, I have a MikroTik Router model RB951Ui-2HnD running version 7.23.2, and I have applied these settings to it: On port Ether1, I have setup the internet via a PPPoE client. On port Ether2, I have setup a network in the 192.168.1.x range with internet access. On port Ether3, I have setup a n…

Windows has a default firewall that only allows pings from the same subnet. Either turn off the firewall, modify the rule or simply don't use ping for testing. UDP will work fine as-is without srcnat.

[image] hamidsaboori63: using ICMP for a ping in my windows days, i saw once that windows firewall blocking ICMP response for foreign source addresses ... ex if win is 192.168.0.2/24 it wont respond for ping from 10.2.2.4/24, only for pings comming from own /24 network regardless of valid de…

Thank you for your attention to this post. I don't have access to the router and computers right now. I will test this at work tomorrow (local time) and let you and the others know the result.

Here are some screenshots of the Windows Defender Firewall inbound rules that by default only let ICMP echo requests from the same subnet through. You need to edit the rules, changing the remote address to Any IP Address if you want your ping tests to succeed. But this only affects ping. The servic…

Yes, the problem was exactly what you pointed out. Disabling the Windows firewall resolved the issue. however, since creating firewall rules across all the Windows machines would have been too time consuming, I opted to meet the organization's requirements using `srcnat` rules instead. Thank you f…

The important thing is to understand the root cause. Sometimes, for practical reasons, it's not the purest solution that ends up being the best overall.

Yes, exactly. There is just one point that was a bit unclear to me. In the 192.168.1.0/24 network, I have a system where the windows firewall allows Remote Desktop access only from a specific IP on another network (e.g., 192.168.10.101). Even though srcnat translates requests from the 192.168.10.…

The principled answer is that there is really no way to do that. Once the src addr is altered, the information is lost from the perspective of the recepient. The obvious solution is to NAT only when you have to. Either selectively where you need it, or excluding specifically where you don't want it…

So, how do you think we can establish a one way connection between two networks? Suppose we want to enable Remote Desktop access from LAN1, but block all requests originating from LAN1 and destined for LAN2. If we simply mark the network traffic moving from LAN1 to LAN2 using Mangle rules and then…

No need to use mangle for that. Assuming RDP clients are in LAN1 and RDP server are in LAN2, just normal plain chain=forward filter rules in this order: Accept in-interface=LAN1 + out-interface=LAN2 + protocol=tcp + dst-port=3389 Accept in-interface=LAN1 + out-interface=LAN2 + protocol=udp + dst-p…

Two networks with different IP ranges in MikroTik

RouterOS General

hamidsaboori63 July 22, 2026, 4:11pm 17

Also, I would appreciate it if anyone could share any solutions or experiences regarding the issue linked below.

Thank you in advance for your cooperation.