Community discussions

MUM Europe 2020
 
desty
just joined
Topic Author
Posts: 4
Joined: Tue Mar 07, 2006 12:53 am

Can do MASQUERADE but not SNAT

Tue Mar 07, 2006 1:04 am

I got problem...
I just install mikrotik @ my pc, 2 NIC, Public and Local. I got multiple Public IP on it and single Local IP. I want to share internet connection with my client, and locate different public ip fo each client.
the problem is.. i cant do SNAT but if I use MASQUERADE its working fine...
So wheres the problem is? I use mikrotik 2.8.26.
Thanks a lot.
[/b]
 
User avatar
andrewluck
Forum Veteran
Forum Veteran
Posts: 702
Joined: Fri May 28, 2004 9:05 pm
Location: Norfolk, UK

Tue Mar 07, 2006 9:46 am

You need to post some more information.

Regards

Andrew
 
desty
just joined
Topic Author
Posts: 4
Joined: Tue Mar 07, 2006 12:53 am

Tue Mar 07, 2006 2:45 pm

You need to post some more information.

Regards

Andrew
Hum its like this...
i got mutiply ip ex. 64.65.66.210-64.65.66.222/28 on ether1
gateway 64.65.66.209
and i got local ip ex.192.168.0.1/32 on ether2
on my pcrouter with mikrotik...
my local ip connected to switch with another pc client ex. 192.168.0.2/32 192.168.0.3/32 and more...
i want to share internet connection to my local client, but because i had multiple public ip i want to specify which local ip go throught which ip public, like
192.168.0.2/32 to 64.65.66.211
192.168.0.3/32 to 64.65.66.212
...
like that,
so i use command like :
add src-address=192.168.0.2/32 out-interface=ether1 action=nat to-src-address=64.65.66.211
looks fine, but it wont work, my client cant connect to the internet.
but if i change action to MASQUERADE it working.

So where is the problem, somebody help me please...
Thank you so much.
Best Regards.
 
User avatar
andrewluck
Forum Veteran
Forum Veteran
Posts: 702
Joined: Fri May 28, 2004 9:05 pm
Location: Norfolk, UK

Tue Mar 07, 2006 8:34 pm

My src-nat rule for my LAN:
chain=srcnat out-interface=Internet src-address=192.168.1.0/24 action=src-nat to-addresses=x.x.x.x to-ports=0-65535
I'm natting for a class C but it works the same for a single IP address as well. Looks like you're missing the 'to-ports' bit.

Do you have connection tracking turned on?

Regards

Andrew
 
User avatar
djape
Member
Member
Posts: 469
Joined: Sat Nov 06, 2004 7:54 pm
Location: Serbia

Tue Mar 07, 2006 9:06 pm

add chain=srcnat out-interface=PublicInterface src-address=192.168.0.2/32 action=src-nat to-addresses=64.65.66.211 to-ports=0-65535

I have noticed by your post that you use version 2.8.x
Check if it's latest 2.8, I mean is it stable...

I hope you didn't post your real addresses :D
If yes, my advice is not to do that anymore.

Cheers..
I drink like a pirate and smoke like a hippie...
 
changeip
Forum Guru
Forum Guru
Posts: 3804
Joined: Fri May 28, 2004 5:22 pm

Tue Mar 07, 2006 9:10 pm

I think 2.8.26 and .27 we're the most stable in that version so he should be good. It's hard to try to support 2.8.x anymore because so many people have moved on : )
 
jarosoup
Long time Member
Long time Member
Posts: 600
Joined: Sun Aug 22, 2004 9:02 am

Tue Mar 07, 2006 10:34 pm

We have had some issues in the past with version 2.8.26 when the firewall is being used. This version is fine for bridges (or ap-bridges) but have stability issues with nat and firewall. Upgrade to 2.8.28 and see if this helps. 2.8.28 has been stable for us with NAT. We'll probably continue to use 2.8.28 until they fix some firewall issues in 2.9 :cry:
 
desty
just joined
Topic Author
Posts: 4
Joined: Tue Mar 07, 2006 12:53 am

Wed Mar 08, 2006 3:35 pm

My src-nat rule for my LAN:
chain=srcnat out-interface=Internet src-address=192.168.1.0/24 action=src-nat to-addresses=x.x.x.x to-ports=0-65535
I'm natting for a class C but it works the same for a single IP address as well. Looks like you're missing the 'to-ports' bit.

Do you have connection tracking turned on?

Regards

Andrew
Hmmm...i just try to insert ports but its not working too... connection tracking turned on :(
Btw... of course its not my real ip :)
Another suggestion? i really need this :( my network over traffic...
 
User avatar
andrewluck
Forum Veteran
Forum Veteran
Posts: 702
Joined: Fri May 28, 2004 9:05 pm
Location: Norfolk, UK

Wed Mar 08, 2006 8:30 pm

From the manual:
masquerade is a special form of source NAT without need to specify to-addresses - outgoing interface address is used automatically
Check the syntax of your source nat rule as what I gave you was for 2.9. I can't remember as far back as 2.8. Especially, check that you're specifying the type of nat that you require.

Regards

Andrew

Who is online

Users browsing this forum: Bing [Bot] and 52 guests