Community discussions

 
Yves
just joined
Topic Author
Posts: 4
Joined: Tue Dec 04, 2018 9:29 am

Public Subnet - Misunderstanding

Tue Dec 04, 2018 10:44 am

Dear MikroTikers,

Recently we finally got our bigger subnet (e.g. 1.1.1.160/27). Unfortunately, this is more of a headache than I thought.

But I think it is due to a mistake in my thinking or a misunderstanding on my part.

Here is a very simple drawing of our network:
Image

The ISP forces us to use his router. However, there is a DMZ mode where all public IPs are passed to the ETH01 from your router. The ETH01 port ISP router (1.1.1.161) is then connected to the MikroTik CCR ETH01. Via IP address we have the address 1.1.1.162/27 from the MikroTik router to the ETH01. To avoid errors we have set up a very simple firewall:

add action=accept chain=input connection-state=established,related
add action=drop chain=input connection-state=invalid log-prefix=invalid_input
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid log-prefix=invalid_forward
add action=drop chain=input in-interface=ISP1
add action=drop chain=forward in-interface=ISP1
add action=masquerade chain=srcnat comment="NAT Masquerade ISP1" out-interface=Init7

The routing tables also look quite normal:

AS 0.0.0.0/0 1.1.1.129 reachable ISP1 Distance 1
DAC 192.168.1.0/24 LAN reachable Distance 0
DAC 1.1.1.160/27 ISP1 reachable Distance 0 pref source 1.1.1.162

Now for my misunderstanding, in my eyes we should now simply be able to set a NAT rule with 1.1.1.165:80 -> 192.168.1.1:80 and a FW rule with accept forward 192.168.1.1:80. But this is not possible, I have to register the IP we want to use as /32 on the ETH01 of MikroTik. I'm just wondering if I can't see the forest for the trees.
Last edited by Yves on Tue Dec 04, 2018 4:05 pm, edited 1 time in total.
 
mkx
Forum Guru
Forum Guru
Posts: 1018
Joined: Thu Mar 03, 2016 10:23 pm

Re: Public Subnet - Misunderstanding  [SOLVED]

Tue Dec 04, 2018 2:07 pm

If router does not have 1.1.1.165 attached to any of its interfaces, it will not reply to ARP address resolution and ISP's router will not find any target MAC to which to send such packet. At the same time, if router does not have 1.1.1.165 attached to one of its interfaces, how is it supposed to know that it should accept packet targeted to this address?

Your dst-nat rule is fine, but unless you attach 1.1.1.165 to eth01 that src-nat rule won't have anything to work on. Before you attach another IP address to your WAN port, check src-nat rule (action=masquerade is not correct anymore, you should use action=src-nat to-addresses=X.Y.W.Z instead).
BR,
Metod
 
Yves
just joined
Topic Author
Posts: 4
Joined: Tue Dec 04, 2018 9:29 am

Re: Public Subnet - Misunderstanding

Tue Dec 04, 2018 4:04 pm

@mkx: thank you very much for clearing that up for me. I was going nuts because of this. Since on the ISP2 where we have a small /30 subnet it works with just the /30 added. But I guess its because that ISP2 interface is directly in our router no router from the ISP in between.

Just to clearify I have to add each and every IP to my ETH01? Correct?
 
mkx
Forum Guru
Forum Guru
Posts: 1018
Joined: Thu Mar 03, 2016 10:23 pm

Re: Public Subnet - Misunderstanding

Tue Dec 04, 2018 6:24 pm

Since on the ISP2 where we have a small /30 subnet it works with just the /30 added. But I guess its because that ISP2 interface is directly in our router no router from the ISP in between.
Probably ISP2 is using your router as gateway for that /30 subnet so packets get pushed to your router.
.
Just to clearify I have to add each and every IP to my ETH01? Correct?
It seems like it.
BR,
Metod
 
sebastia
Long time Member
Long time Member
Posts: 662
Joined: Tue Oct 12, 2010 3:23 am

Re: Public Subnet - Misunderstanding

Tue Dec 04, 2018 8:42 pm

Another option would be to not do nat and keep all (the main) devices in same subnet, BUT put a transparent firewall in-between: basically forward all bridge traffic to firewall and validate it there. One can even do packet mangling and priotisation if needed

Edit: similar to this https://www.youtube.com/watch?v=6eeYac5xBrE

Who is online

Users browsing this forum: rimelis and 62 guests