VRF with 3 Isolated NAT Networks route from 3 external IPs

RouterOS General
1

Good day, all

I am struggling to setup an internal network with 3 isolated NAT networks with the same Sub-net range. I need to route traffic to and from 3 identical VRF NATs from 3 external IP addresses. The 3 NAT networks need to be the same sub-net range as the devices on the NAT interfaces have fixed IP addresses in the 192.168.0.1/24 range.
I.e. Ether1 will have static IP addresses 192.168.3.10-12
192.168.3.10 will NAT and route to Ether2 only
192.168.3.11 will NAT and route to Ether3 only
192.168.3.12 will NAT and route to Ether4 only
Ether2-4 all have subnet range 192.168.0.1/24

I have the following script, but I seem to be doing something wrong, this script is trying to talk to 192.168.0.11 on each VPC.

Script.txt (2.58 KB)
Kind regards
Nicholas K
Network Diagram.png

2

If it is v7, you are seemingly missing the explicit declaration of the three rouiting tables.
It is better if you post your whole configuration (as opposed to the parts that you believe relevant) as the devil is in the details.

3

Good day, jaclaz
Thanks for your response!
I am starting with a Blank Config (Not defaults) and the running the script I have attached in my above post. In the first few lines I add the three VRF’s with

/IP vrf add

.
Am I possibly missing other core configurations to get this working?

Kind regards,
Nicholas K

4

So you have no firewall filter rules that may interfere?

I see now that you did declare the vrf’s, my bad :blush: .

I don’t particularly appreciate your naming scheme, when/if you will need to use ether2@port1 you will see why, but this is irrelevant.

I cannot see anything blatantly “wrong”, but we do have a reported to be working configuration that you could try here:
http://forum.mikrotik.com/t/vrf-lite-with-mangle-and-dstnat-to-reach-multiple-vlans-with-overlapping-ips/174948/1
http://forum.mikrotik.com/t/vrf-lite-with-mangle-and-dstnat-to-reach-multiple-vlans-with-overlapping-ips/174948/1
If I were you, I would experiment with that approach.

Personally I would name vrfs as vrf2, vrf3 and vrf4 and put ether2 in vrf2, ether3 in vrf3 and ether4 in vrf4, but that is just me.

5

Good day, Jaclaz
Yes, I have no firewall filter rules. I agree on the naming of the VRF’s, I was using an old script done by someone else and didnt want to change much since it wasnt working.
I will the other topic scripts a try, thanks!

Kind regards
Nicholas K