Community discussions

 
jasonsoscomm
just joined
Topic Author
Posts: 8
Joined: Wed Aug 21, 2019 6:03 pm

How to change source IP to destination network

Wed Aug 21, 2019 6:08 pm

Hello! I am needing to create a Nat rule/s that if I request a network IP on a private network of 172.21.0.0 that my source IP becomes 172.21.2.33

Logic:
If dst = 172.21.x.x
then src = 172.21.2.33

The router has a public IP and a private IP on port Etha0
I have this address (172.21.2.33 ) added to Port Eth0

How can I write this rule in RouterOS?
 
jasonsoscomm
just joined
Topic Author
Posts: 8
Joined: Wed Aug 21, 2019 6:03 pm

Re: How to change source IP to destination network

Thu Aug 22, 2019 8:46 pm

This is what I tried:
/ip firewall nat
add action=src-nat chain=srcnat dst-address=172.21.0.0/24 to-addresses=172.21.2.33
But this does not seem to work. Is this the right way to accomplish this? How do I test this?
 
Sob
Forum Guru
Forum Guru
Posts: 4549
Joined: Mon Apr 20, 2009 9:11 pm

Re: How to change source IP to destination network

Thu Aug 22, 2019 11:13 pm

If 172.21.x.x means that target network includes all addresses with any last two numbers, then the correct mask is /16. Other than that, the rule does exactly what you described it should do. If it doesn't work, there may be something else missing. Try to describe in more detail how the whole thing should work, what's connecting where, exact source and destination, where everything is, etc.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply.
 
jasonsoscomm
just joined
Topic Author
Posts: 8
Joined: Wed Aug 21, 2019 6:03 pm

Re: How to change source IP to destination network

Fri Sep 06, 2019 1:23 am

So here is the network, The office router is sitting in a Rack that our Service network is attached to. the 172.21.x.x/16 network. The devices are Ubiquity Radios that are connected to a MikroTik router and there is a Fiber backhaul to our data room at our main office. What I am doing is segregating out office network to the new MikroTik router and setting up VPN and DHCP for the office.
Right now the DHCP clients can connect to any server that is on the network in the same rack with the private network of 172.21.x.x/16.

The goal is for anyone that is on the office network to be able to access any Ubiquity device on the service network.
 
martinclaro
newbie
Posts: 30
Joined: Sat Sep 28, 2013 6:08 am
Location: Buenos Aires, Argentina
Contact:

Re: How to change source IP to destination network

Fri Sep 06, 2019 1:54 am

---EDITED---
Try to put the srcnat rule before other srcnat/masquerade rules and do a traceroute to see what happens.
Martín C. @ TopHost Soluciones
MTCNA | MTCTCE
 
User avatar
SiB
Member Candidate
Member Candidate
Posts: 150
Joined: Sun Jan 06, 2013 11:19 pm
Location: Poland

Re: How to change source IP to destination network

Fri Sep 06, 2019 2:45 am

AnyOne who have 2 Public IP can do:
* /ip firewall nat add action=src-nat chain=srcnat dst-address=208.67.222.222 to-addresses=172.21.2.33 place-before=0 disabled=no
* /put [resolve server=208.67.222.222 domain-name=myip.opendns.com]

And now we can easy check what PublicIP see the OpenDNS (now Cisco).
This rule is little similar to HairPinNat when we speak about the same /24 cidr subnet but of course your example is at internet.
MTCNA + MTCRE + MTCINE | ~600 users at ~150 RouterBoards in EMEA | Telegram: @SiB_PL | WebChat: Tokonda
 
User avatar
Anumrak
Forum Veteran
Forum Veteran
Posts: 993
Joined: Fri Jul 28, 2017 2:53 pm

Re: How to change source IP to destination network

Thu Sep 12, 2019 5:03 pm

This is what I tried:
/ip firewall nat
add action=src-nat chain=srcnat dst-address=172.21.0.0/24 to-addresses=172.21.2.33
But this does not seem to work. Is this the right way to accomplish this? How do I test this?
Also, specify outbound interface to understand what you are doing.
 
mazenco
just joined
Posts: 4
Joined: Thu Feb 11, 2016 8:33 am

Re: How to change source IP to destination network

Sat Sep 14, 2019 11:01 am

I have the same problem my mikrotik configuration as follow
mikrotik Lan ip is 10.10.10.10
Wan interface ip 10.10.9.2
then the traffic route form wan to FortiGate (there are no masquerade rule on mikrotik)
The Nat Doing On FortiGate router
i am need to change source Ip of subnet 10.10.4.0/24 to 10.100.20.0/24 when destination network was 10.12.0.0/24 (tunnel)
because the VPN Tunnel On FG allows only subnet 10.100.20.0/24 to pass through
So when I need to access any device with Destination 10.12.0.0/24 , I must do it from devices that have ip subnet 10.100.20.0/24
what is the solution to Subnet 10.10.4.0/24 ?
 
User avatar
SiB
Member Candidate
Member Candidate
Posts: 150
Joined: Sun Jan 06, 2013 11:19 pm
Location: Poland

Re: How to change source IP to destination network

Mon Sep 16, 2019 10:56 pm

I have the same problem my mikrotik configuration as follow
mikrotik Lan ip is 10.10.10.10
Wan interface ip 10.10.9.2
then the traffic route form wan to FortiGate (there are no masquerade rule on mikrotik)
The Nat Doing On FortiGate router
i am need to change source Ip of subnet 10.10.4.0/24 to 10.100.20.0/24 when destination network was 10.12.0.0/24 (tunnel)
because the VPN Tunnel On FG allows only subnet 10.100.20.0/24 to pass through
So when I need to access any device with Destination 10.12.0.0/24 , I must do it from devices that have ip subnet 10.100.20.0/24
what is the solution to Subnet 10.10.4.0/24 ?
Please read first Getting the most out of this forum
This is not the same situation and you should create new post.
What is "10.10.4.0/24"? You say your LAN is 10.10.10.10. Please read your post in Preview before submit it.

About your case.
At MikroTik who is after other router like FortiGate must have a directly connected network with it. I understand that "Wan interface ip 10.10.9.2" is on MikroTik and 10.10.9.1 is on FortiGate.
When you not use SNAT/Masq NAT rule then you used a routing itself, this mean your LAN 10.10.10.10 or/and 10.10.4.0/24 is out to FG as original address.

This FortiGate must have do a SNAT rule to hide your 10.10.10.10 or/and 10.10.4.0/24 as 10.100.20.0/24 because this 10.100.20.0/24 is internal network inside FortiGate, this is not MikroTik network.
You cannot do SNAT (hide src address) as not your network. SNAT can change incomming not-your network as one of yours networks. Means you can hide 10.10.10.10 and/or 10.10.4.0/24 as 10.10.9.2. When you do it then still FG must do SNAT to hide your 10.10.9.2 as 10.100.20.0/24.

If I not answer you properly that means you wrongly describe problem, not use a diagram. Please read first Getting the most out of this forum
MTCNA + MTCRE + MTCINE | ~600 users at ~150 RouterBoards in EMEA | Telegram: @SiB_PL | WebChat: Tokonda

Who is online

Users browsing this forum: Bing [Bot] and 22 guests