HI
please i need help with let a ip with the real interface to access the fake (local Network) in the microtik software
Dear Proxyi don't understand your question!
I Have 2 different networks connectied thru microtik router
first network to a interface called fake with range 192.168.0.0
second network to a interface called real with range 11.11.11.0
with my configuraton in the firewall i can choose the ip in the fake range that will go connect to the real network bu i cannot make a real ip for example 11.11.11.56 from connecting to the fake network
best regards
Dear Proxyi don't understand your question!
I Have 2 different networks connectied thru microtik router
first network to a interface called fake with range 192.168.0.0
second network to a interface called real with range 11.11.11.0
with my configuraton in the firewall i can choose the ip in the fake range that will go connect to the real network bu i cannot make a real ip for example 11.11.11.56 from connecting to the fake network
best regards
dear valens
do u need any other configuration i have too many filters in my firewall
Code: Select all
[admin@Active] > int
[admin@Active] interface> pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R Fake ether 0 0 1500
1 R Real ether 0 0 1500
[admin@Active] > int
[admin@Active] interface> pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R Fake ether 0 0 1500
1 R Real ether 0 0 1500
[admin@Active] ip firewall mangle> pr
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting action=passthrough
-
-
wildbill442
Forum Guru
- Posts: 1055
- Joined:
- Location: Sacramento, CA
It sounds like he's trying to do DST-NAT.
To NAT a "real" or publicly routeable IP address to an internal "fake" private side address..
The masquerade rule would be as follows:
Now if you want someone to access an internal server that has an IP address of say 192.168.0.20 and the public address is say 11.11.11.56, you need to create a dst-nat rule. Which would look like this:
Hope this helps.
To NAT a "real" or publicly routeable IP address to an internal "fake" private side address..
The masquerade rule would be as follows:
Code: Select all
/ip firewall nat add chain=srcnat out-interface=WAN src-address=192.168.0.0/24 action=masquerade comment="masquerade" disabled=noCode: Select all
/ip firewall nat add chain=dstnat dst-address=11.11.11.56 action=dst-nat to-addresses=192.168.0.20 to-ports=80 comment="http server" \
disabled=no 
-
-
wildbill442
Forum Guru
- Posts: 1055
- Joined:
- Location: Sacramento, CA
soleed pleace be so kind and DO READ
NAT
http://www.mikrotik.com/docs/ros/2.9/ip/nat
IP addressing and routing
http://www.mikrotik.com/docs/ros/2.9/ip/address
that way you could understand these things better. pleace make it clear what you want in terms we all use here and then come and ask questions and we will kindly answer.
NAT
http://www.mikrotik.com/docs/ros/2.9/ip/nat
IP addressing and routing
http://www.mikrotik.com/docs/ros/2.9/ip/address
that way you could understand these things better. pleace make it clear what you want in terms we all use here and then come and ask questions and we will kindly answer.
-
-
wildbill442
Forum Guru
- Posts: 1055
- Joined:
- Location: Sacramento, CA
Soleed,
the IP address that you are trying to NAT to the internal network must be assigned to the WAN or "real" interface (you can have more than one IP assigned to a single interface).
Remove the to-ports=80 that was incorrect, instead replace it with 0-65535 that will forward all requests going to 11.11.11.56 to your internal address 192.168.0.216. so to recap.. the command would look like this:
remove the old rule that was forwarding to port 80.
You could forward just port 80, by appending the previous command like so:
the IP address that you are trying to NAT to the internal network must be assigned to the WAN or "real" interface (you can have more than one IP assigned to a single interface).
Remove the to-ports=80 that was incorrect, instead replace it with 0-65535 that will forward all requests going to 11.11.11.56 to your internal address 192.168.0.216. so to recap.. the command would look like this:
Code: Select all
/ip firewall nat add chain=dstnat dst-address=11.11.11.56 action=dst-nat to-addresses=192.168.0.216 to-ports=0-65535 comment="http server" \
disabled=noYou could forward just port 80, by appending the previous command like so:
Code: Select all
/ip firewall nat add chain=dstnat dst-address=11.11.11.56 dst-port=80 action=dst-nat to-addresses=192.168.0.216 to-ports=80 comment="http server" \ disabled=no-
-
wildbill442
Forum Guru
- Posts: 1055
- Joined:
- Location: Sacramento, CA
Well can you ping 192.168.0.216 from the Mikrotik? Maybe the 192.168.0.216 host has a firewall blocking ICMP echo requests.. Maybe you have a filter in the mikrotik firewall blocking ICMP echo.. You're doing something wrong and unless you post your configuration I can't help you any further.man my laptop is 11.11.11.50 the microtik real intefrace ip 11.11.11.56 the fake mikrotik ip is 192.168.0.254 the internal web server ip 192.168.0.216
and my laptop gateway is 11.11.11.56 and i did all the configuration you give me
but sorry NO PING