MikroTik

Hi,

i am trying to solve issue, where IP is not showing from PC that is trying to connect to it, but only mikrotiks 192.168.0.1 i tried to solve this issue with synology forum (summarized to forum.mikrotik.com) , where i thought was a problem, but they told me its my router and to be completely honest i dont know what i did wrong on my mikrotik settings.

Thanks a lot for help,
Neyoneit

I assume that in order for you to get an answer you need to clarify what do you mean with

where IP is not showing from PC that is trying to connect to it, but only mikrotiks 192.168.0.1

This doesn't make sense to me. Say what you wanted in the first place.

thats why i included forum link where i did explain it further. i can copy it all here, but i thought i might be unneccesary

Attached picture wtf.jpg is my synology device showing many ppl trying to connect.. but shows ip of router instead of theirs ip.
and other pictures shows settings in mikrotik for that port forward

I hopw its better explained what i mean

I just saw the signature of one guru member in the forum. it says "People who quote full posts should be spanked with an ethernet cable. Some exceptions for multi-topic threads may apply."

These images, you just posted, makes me understand that you have enabled port forwarding from port 22 (TCP) of the WAN interface of your router to port 22 of 192.168.0.7.

Is 192.168.0.7 the IP address of your NAS? Can you please explain the problem again?

I do apologize for my ignorance ill try to do better now. (i am using quote to see what i am repplying to, then i forgot and sometimes keep forgeting to delete it)

My NAS is on 192.168.0.7 IP
i have port forwarded port 22, 5000, 5001, 6690 and now changed them from default to different ones 2233, 5555, 5556, 6690(one stayed not changed) just to avoid constant spam from bots trying to acces my NAS.
DSM - means web acces just to clarify from one of the pictures ive attached.

When someone either from web -DSM (5000port), or Cloudstation(6690port) or SSH (22port) it all shows in NAS protocol as 192.168.0.1 and i dont know why.

My friend who helped me setup mikrotik says its set correctly, but i have to solve this issue, because everyone who fails several times login gets blocked as they should, but it blocks everyone basicaly. because everyone is showing as 192.168.0.1.

Enabling port forwarding of port 22 from the Internet to your NAS will, obviously, expose it to the wild. I assume many bots are trying to connect to it using default username/passwords. That is why you have so many login failure attempts. But one thing is very strange: all these attempts are coming from 192.168.0.1 which is the router's LAN IP, isn't it?

It seems to me that there is a source nat rule in your configuration that is source-natting all your Internet requests. This might be a mistake or also might be a way to enable the LAN clients to use the same port forwarding from the WAN ip address of your router.

Most probably the NAS is blacklisting all requests coming from 192.168.0.1. And because you have source nat, all requests come from 192.168.0.1. And because of all mentioned no one can access your NAS. Is this the problem?

Can you please post the output of the following command
/ip firewall nat export
and then again post the output of the same command but with extra parameters
/ip firewall nat export verbose terse

Please post output of command /export hide-sensitive (run it from a command window) ... and obfuscate public addresses ... paste it inside [code][/code] environment for better readability.

No need for verbosity, but do post complete setup, sometimes problems are hidden elsewhere.

yes i can, sorry it took longer i had to find out how to export terminal

The first rule in your /ip firewall nat configuration is the following:
/ip firewall nat add action=masquerade chain=srcnat

It seems to me that it doesn't have any interface specified, meaning that it will source nat everything going out from all interfaces.

Can you specify the outgoing interface in this rule to be your WAN interface? To me, this will solve your problem but might cause some other issues regarding the accessibility of the LAN users to forwarded ports from the WAN interface. Sill, make the test and let us know the result.

Yes, this seems to be what is masking everyones IP, when i disabled it i could see IP logging into NAS, but all my connections dropped i mean i couldnt load any page on computers connected to my router., so i enabled it again.
To be honest i dont know much - because my friend set it up for me, and he is not around atm..

You need that rule, but add out-interface=ether1 to it. Now it's changing source address of all connections, but you only need this for connections to internet.

As @sob said you need that rule. Do not disable it. You need to change it.
What you need to do is log in with winbox, go to IP -> Firewall -> NAT, then click on that rule, go to the General tab and in the Out. Interface from the drop down menu select the WAN interface your router is using.

Oh good lord it seems to be working!!!
Thank you @ros44, @sob, @mkx

I do very much appreciate ur help!