Using NAT on Mikrotik

RouterOS Beginner Basics
1

Hey, I am new to Mikrotik and I am trying to configure my own network. So far I got a router which has on every port (1-5) different subnets (10.10.1.0, 10.10.2.0,..,10.10.5.0). Ive connected a raspberry pi with the ip address 10.10.1.1 with port 1 (subnet 10.10.1.0) and my laptop to port 5. My laptop has the ip addresss 10.10.5.2. After that I set some firewall rules. My “private” subnet is 10.10.1.0 and my “public” is 10.10.5.0. First of all I activated source nat for the public subnet:

/ip firewall nat add chain=srcnat src-address=10.10.5.0/24 action=masquerade out-interface=ether5 to-address=10.10.5.50/24

my nat rules look like this:

[admin@Router-10] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
 0    chain=dstnat action=dst-nat to-addresses=10.10.1.1 to-ports=22
      protocol=tcp dst-port=10022

 1    chain=srcnat action=masquerade to-addresses=10.10.5.50
      src-address=10.10.1.0/24

so after that I add some filters:

[admin@Router-10] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
 0    chain=forward action=drop src-address=10.10.5.0/24
      dst-address=10.10.1.0/24

 1    chain=forward action=drop connection-state=new dst-address=10.10.1.0/24

 2    chain=forward action=drop connection-nat-state=!dstnat
      dst-address=10.10.1.0/24

now I want to connect via ssh to my raspberry pie from laptop. For that I added port mapping:

/ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.10.1.1 to-ports=22
      protocol=tcp dst-port=10022

But I can’t establish a connection. Why that?

2

Network diagram often helps understand what you are doing,
need full config
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

3

First of all, thank you for the reply. I attached a drawing of my network hope this is fine. So my main Problems are. I can’t ping from my raspberry my pc and can’t connect via ssh with my raspberry from my pc. So I post here the routing table of the raspberry pi:
0.0.0.0 10.10.1.254 0.0.0.0
10.10.1.0 0.0.0.0 255.255.255


The firewall setting which I configured had I posted above. The routing table of the router is the following:
[admin@Router-10] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit

DST-ADDRESS PREF-SRC GATEWAY DISTANCE

0 ADC 10.10.1.0/24 10.10.1.254 ether1 0
1 DC 10.10.2.0/24 10.10.2.254 ether2 255
2 DC 10.10.3.0/24 10.10.3.254 ether3 255
3 DC 10.10.4.0/24 10.10.4.254 ether4 255
4 ADC 10.10.5.0/24 10.10.5.254 ether5 0

Pls inform me of the settings you need to see.
IMG_3464.jpg

4

My main problem are my filters and nat rules. Why can I not do an ssh with my raspberry pi? I tried some things. First I removed all filters then the masking worked, but I didn’t got a ping reply , when I tried to ping from the raspberry to the pc. The ssh worked without the filters. When I activate the filters again nothing worked.

5

Please don’t double post, I believed the issue here is the same with your other post which i reply as well

It is common issue with new user is that they don’t RTFM i believed it was mentioned in the docs that you should enumerate your WAN and LAN interface in the interface list, so that you are not going to be surprise why it’s not working, the default firewall rules of mikrotik is sane for your own good you just have to read a little bit on how things done

6

Hey, yeah sure but i want to separate a little bit between these two topics. The problem with ssh is now working. It was the filters. After i put the rule in ONE filter then the ssh worked.
The problem now is that my pc doesnt send a ping reply too the masked ip address of the raspberry.