Community discussions

MUM Europe 2020
 
jeremyh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 66
Joined: Tue Jul 10, 2012 1:21 pm

1:1/reverse NAT - appropriate?

Sun Nov 11, 2012 8:07 am

Hello,

Well, this is my second time typing this post - the first time I clicked submit, the forum logged me out and I lost the lot! Frustrating! Oh well.

Our business recently acquired another, which comes with four users and a fully kitted-out win2k8 server (mail, file etc.). We're moving this other business in-house, and wish to place them on a separate subnet, so that their server and network can continue running as before.

The problem is that because of logistical and practical limitations with our building, we are forced to use EoP (ethernet over power) in place of cable drops. So our router is therefore configured with all the ports switched/bridged, and there's no possibility of using a dedicated port to connect the second organisation.

What I'd like to do, then, is place this second organisation behind a mikrotik router which is doing NAT in 'both directions' - so that any host can talk to any other host, and we can share resources. The simple network diagram should illustrate what I mean. Is this possible using hairpin nat or 1:1 nat or should I be looking at something else? I'm open to using a VLAN or something if someone would be kind enough to point me in the right direction. I've tried playing around with 1:1 NAT but didn't get anywhere so thought I would ask for help.

To repeat for clarity - there's no way that I can run a cable from our router to theirs. We can only use EoP, which just works as a L2 switch.
I presently have this second network just running behind a cheap home router which is working fine, except that we can't reach hosts on their network and I'd like a mikrotik-level of control over the traffic.

Many thanks,
Jeremy
You do not have the required permissions to view the files attached to this post.
 
vk7zms
Member Candidate
Member Candidate
Posts: 227
Joined: Thu Jun 29, 2006 3:01 am
Location: Hobart, Tasmania
Contact:

1:1/reverse NAT - appropriate?

Mon Nov 12, 2012 10:52 am

Any reason you don't just an ip address from each subnet (the default gateway address for network hosts) onto the RB1100 LAN bridge interface. Down side is you will have to static ally assign addresses on one subnet as both subnets are on the same L2 segment.
 
vk7zms
Member Candidate
Member Candidate
Posts: 227
Joined: Thu Jun 29, 2006 3:01 am
Location: Hobart, Tasmania
Contact:

1:1/reverse NAT - appropriate?

Mon Nov 12, 2012 10:58 am

Looking at you network diagram you have Ethernet cables between network2 and the hosts on this network - if so a better solution would be to define a VLAN on the RB1100 LAN bridge interface and on a single port of your second mikrotik. Just add the remaining ports and the VLAN to a bridge and move the default gateway address for network2 onto the VLAN interface on the RB1100
 
jeremyh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 66
Joined: Tue Jul 10, 2012 1:21 pm

Re: 1:1/reverse NAT - appropriate?

Tue Nov 13, 2012 12:01 pm

Any reason you don't just an ip address from each subnet (the default gateway address for network hosts) onto the RB1100 LAN bridge interface. Down side is you will have to static ally assign addresses on one subnet as both subnets are on the same L2 segment.
Looking at you network diagram you have Ethernet cables between network2 and the hosts on this network - if so a better solution would be to define a VLAN on the RB1100 LAN bridge interface and on a single port of your second mikrotik. Just add the remaining ports and the VLAN to a bridge and move the default gateway address for network2 onto the VLAN interface on the RB1100
Thanks for your reply Murray.

I ended up 'solving' the problem just before you posted your replies. Rather than create the network on the RB2011, I added an address to the RB1100's bridge like so:
/ip address add address=192.168.1.34/32 interface=bridge1 network=192.168.89.0

/ip firewall nat add action=dst-nat chain=dstnat comment="Forward port 25 (SMTP) to mail server on network 2" dst-address=XXX.XXX.XXX.XXX dst-port=25 protocol=tcp to-addresses=192.168.89.2 to-ports=25

/ip route add comment="For network 2" dst-address=192.168.89.0/24 gateway=192.168.1.33
On the second router I set everything up as normal so it's doing DHCP, nat etc (with DNS going through the first router, which is ideal):
/ip address
add address=192.168.89.1/24 comment="default configuration" interface=bridge-local
add address=192.168.1.33/24 interface=ether1-gateway

/ip address
add address=192.168.89.1/24 comment="default configuration" interface=bridge-local
add address=192.168.1.33/24 interface=ether1-gateway

/ip route
add distance=1 dst-address=192.168.1.0/24 gateway=ether1-gateway

Now, this works, and I can indeed get to any host on either network from the other. But if there's some reason that this isn't a good solution, please tell me. I'm intrigued by your suggestion of VLANs and would like to give it a go at some point.

Cheers,
J

Who is online

Users browsing this forum: No registered users and 24 guests