Community discussions

MikroTik App
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

NAT not working

Thu Aug 04, 2016 1:44 am

I have configured wlan at address 192.168.4.1 and it can dhcp addresses through 192.168. 4.2/254 . I want to send all the traffic to 192.168.4.244 irrespective of the destination address. So I have put these addresses in address list , marked the packets and also put rules to dst-nat all the packets which are coming from 192.168.4. 2-192.168.4.254 to 192.168.4.244 and port 80 as I have hosted website here. It isn't working , I also have reachable routes... please help.
 
User avatar
ochaconm
Trainer
Trainer
Posts: 28
Joined: Fri Feb 22, 2013 9:39 pm

Re: NAT not working

Thu Aug 04, 2016 2:29 am

If I understood it correctly... Your WLAN IP is 192.168.4.1 and your DHCP pool is 192.168.4.2-192.168.4.254. You want to redirect traffic coming from your LAN to a host that is located in the same subnet(192.168.4.244). I suggest you to connect your server to a different interface and subnet (ex: servers on 192.168.3.0/XX on etherX) and do not bridge WLAN and EtherX. You will not be able to dst-nat your traffic to the same subnet. I hope this help you.
One more thing, If your server is also wirelessly connected, you can create a virtual AP and assign it to a different subnet and finally connect your server to this subnet. If you can, post an image of your network topology.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Thu Aug 04, 2016 5:29 pm

If I understood it correctly... Your WLAN IP is 192.168.4.1 and your DHCP pool is 192.168.4.2-192.168.4.254. You want to redirect traffic coming from your LAN to a host that is located in the same subnet(192.168.4.244). I suggest you to connect your server to a different interface and subnet (ex: servers on 192.168.3.0/XX on etherX) and do not bridge WLAN and EtherX. You will not be able to dst-nat your traffic to the same subnet. I hope this help you.
One more thing, If your server is also wirelessly connected, you can create a virtual AP and assign it to a different subnet and finally connect your server to this subnet. If you can, post an image of your network topology.

Hey, thanks for answering. I tried your way but it isn't working. However if I connect to wlan and host my website from a laptop connected to same wlan. I can access it. But it isn't happening with dst-nat rule.

PS I am not connected to dns can that be a problem? but if I put ip address of laptop hosting website it can access the site. So is not being connected to DNS a problem or not.
 
User avatar
czolo
Member
Member
Posts: 418
Joined: Fri Mar 04, 2005 9:49 am
Location: Poland (Warsaw)
Contact:

Re: NAT not working

Thu Aug 04, 2016 7:53 pm

Post here
/ip fi fi pr
/ip fi nat pr
| --= Czo|_o =--
| http://wifi4eu.pl
| Innovation in WiFi
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Thu Aug 04, 2016 9:09 pm

If your server is also wirelessly connected, you can create a virtual AP and assign it to a different subnet and finally connect your server to this subnet.
Hey, thanks for answering. I tried your way but it isn't working. However if I connect to wlan and host my website from a laptop connected to same wlan. I can access it. But it isn't happening with dst-nat rule.

PS I am not connected to dns can that be a problem? but if I put ip address of laptop hosting website it can access the site. So is not being connected to DNS a problem or not.
I second ochaconm's suggestion - probably you missed something in your configuration when attempting it.
Step1) make the second wlan with its own IP range / dhcp / etc - and connect to it to make sure that it works, granting Internet access.
Step2) make sure that original wlan clients are still able to reach Internet, and are able to reach the test server when it is connected to the new wlan (using IP address)
Step3) put in your dst-nat rule, but use to-address=the IP of the server on its new network (not inside of 4.x) and test again from the .4 network

Basically the idea is to do things one step at a time, and make sure things are working at that point, and then adding the extra features until you have the functionality you want.

The most likely reason it's not working on the same LAN is that you also need a hairpin NAT rule in the srcnat chain:
/ip firewall nat add chain=srcnat dst-address=192.168.4.244 src-address=192.168.4.0/24 action=masquerade
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
User avatar
ochaconm
Trainer
Trainer
Posts: 28
Joined: Fri Feb 22, 2013 9:39 pm

Re: NAT not working

Thu Aug 04, 2016 10:52 pm

That is a good solution ZeroByte. I miss understood the problem. It won't work only when the original "src address " and "dst address" and are on the same subnet(ip is reached by ARP). But I think that it is not a problem. Thanks for clarifying.

Enviado desde mi SM-G900F mediante Tapatalk
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Wed Aug 10, 2016 5:34 pm

Hi,
Sorry it took long.
ip fi fi pr
chain=unused-hs-chain action=pass through log=no log-prefix=""

ip fi Nat pr
0 chain=dstnat action=netmap to-address=192.168.1.3 to-ports=80 protocol=TCP dst-address=1.1.1.1 dst-port=80 log=no log-prefix=""

1 chain=srcnat action=masquerade src-address=192.168.4.0/24 log=no log-prefix= ""

2 chain=srcnat action=masquerade src-address=192.168.5.0/24 log=no log-prefix=""
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Wed Aug 10, 2016 8:57 pm

change the netmap action to dstnat - dstnat is stateful and will automatically translate the replies from your webserver. netmap will not do this, and that's why things are broken.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Wed Aug 10, 2016 9:52 pm

change the netmap action to dstnat - dstnat is stateful and will automatically translate the replies from your webserver. netmap will not do this, and that's why things are broken.
I have a server on 192.168.4.253 I want redirect all those connected to 192.168.4.0 and 192.168.5.0 network to this address. Also as you said earlier if this is not possible , how can I put the server on ether network 192.168.2.0 and redirect to this server. I want a captive portal on wlan1 and wlan2 both are access point and wlan2 is virtual access point.

Thanks in advance.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Wed Aug 10, 2016 9:58 pm

I'd say to do this on your dstnat rule:

protocol=tcp
dst-port=80
src-address= [!] ip.of.server
action=dst-nat
to-address=ip.of.server

(check the ! box, which means "not")

So in English, this rule says: For all TCP packets whose destination port is 80 and whose source IP is not the special server, change the destination address to the special server.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Wed Aug 10, 2016 11:02 pm

I'd say to do this on your dstnat rule:

protocol=tcp
dst-port=80
src-address= [!] ip.of.server
action=dst-nat
to-address=ip.of.server

(check the ! box, which means "not")

So in English, this rule says: For all TCP packets whose destination port is 80 and whose source IP is not the special server, change the destination address to the special server.
I put this rule in NAT table. But then when I connected my mobile to 192.168.4.0 network and tried to access Facebook it didn't redirect me to my server , it just said page cannot be reached . To reach server I have to put its ip.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Thu Aug 11, 2016 12:09 am

re-post your nat chains:

/ip firewall nat export
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Thu Aug 11, 2016 12:29 pm

re-post your nat chains:

/ip firewall nat export
/ip firewall nat
add action=masquerade chain=srcnat comment="our rules" disabled=yes \
dst-address=192.168.2.0/24 src-address=192.168.5.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.2.0/24 \
src-address=192.168.4.0/24
add action=masquerade chain=srcnat comment="default configuration" disabled=yes \
out-interface=ether1-gateway
add action=dst-nat chain=dstnat comment="our rules" disabled=yes dst-address=\
0.0.0.0/0 in-interface=wlan1 packet-mark=capture protocol=tcp src-address=\
192.168.4.0/24 to-addresses=192.168.4.253 to-ports=80
add action=dst-nat chain=dstnat disabled=yes dst-address=0.0.0.0/0 \
in-interface=wlan1 packet-mark=capture protocol=udp src-address=\
192.168.4.0/24 to-addresses=192.168.4.253 to-ports=80
add action=dst-nat chain=dstnat disabled=yes in-interface=wlan2 packet-mark=\
capture1 protocol=tcp src-address=192.168.5.0/24 to-addresses=192.168.4.253 \
to-ports=80
add action=dst-nat chain=dstnat disabled=yes in-interface=wlan2 packet-mark=\
capture1 protocol=udp src-address=192.168.5.0/24 to-addresses=192.168.4.253 \
to-ports=80
add action=dst-nat chain=dstnat dst-address=192.168.4.253 dst-port=80 protocol=\
tcp src-address=!192.168.4.253 to-addresses=192.168.4.253
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Thu Aug 11, 2016 4:30 pm

okay - first thing - packet marks are usually not used for NAT... There are some ways you might do packet marking to drive NAT, but that's pretty rare, and not necessary for what you want to do.

I'm going to assume that the http site you're redirecting to is still hosted on 192.168.4.253...... so here is what the rules should look like:

/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1-gateway
add chain=srcnat action=masquerade dst-address=192.168.4.0/24 src-address=192.168.4.0/24
add chain=dstnat action=dst-nat dst-port=80 protocol=tcp src-address=!192.168.4.253 to-addresses=192.168.4.253

That's all you need.

EDITED to put the chain in there - whoops.
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Thu Aug 11, 2016 5:01 pm

okay - first thing - packet marks are usually not used for NAT... There are some ways you might do packet marking to drive NAT, but that's pretty rare, and not necessary for what you want to do.

I'm going to assume that the http site you're redirecting to is still hosted on 192.168.4.253...... so here is what the rules should look like:

/ip firewall nat
add action=masquerade out-interface=ether1-gateway
add action=masquerade dst-address=192.168.4.0/24 src-address=192.168.4.0/24
add action=dst-nat dst-port=80 protocol=tcp src-address=!192.168.4.253 to-addresses=192.168.4.253

That's all you need.

Thanks sir , I will try this shortly. Would you tell me why second rule? Because since I have two ap I will have to write second rule for that too .
PS would you mention chain please. I am new to this.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Thu Aug 11, 2016 5:15 pm

Whoops - I forgot to specify the chain in my rules.

You do not need a rule for 192.168.5.0/24

These rules are the only ones you need.

Rule 1: standard, everyday old-fashioned "NAT when going out to the Internet" rule
Rule 2: "hairpin rule" - if redirecting from 192.168.4.X hosts to a destination of 192.168.4.253, then you need this rule so that the replies from 4.253 will be sent to the router to get mapped back to whatever reply IP the original 4.X host was expecting.
Rule 3: this rule redirects port 80 to go to 4.253 for any possible destination, unless the request is actually coming from 4.253 itself.

You do not need any more rules than this to do what you've specified: redirect ALL web to 4.253 and allow it to work from 4.x network.
(5.x network does not require hairpin NAT since it's in a different network entirely from 4.x)
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Thu Aug 11, 2016 5:17 pm

okay - first thing - packet marks are usually not used for NAT... There are some ways you might do packet marking to drive NAT, but that's pretty rare, and not necessary for what you want to do.

I'm going to assume that the http site you're redirecting to is still hosted on 192.168.4.253...... so here is what the rules should look like:

/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1-gateway
add chain=srcnat action=masquerade dst-address=192.168.4.0/24 src-address=192.168.4.0/24
add chain=dstnat action=dst-nat dst-port=80 protocol=tcp src-address=!192.168.4.253 to-addresses=192.168.4.253

That's all you need.

EDITED to put the chain in there - whoops.
It's not working
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Thu Aug 11, 2016 5:29 pm

Whoops - I forgot to specify the chain in my rules.

You do not need a rule for 192.168.5.0/24

These rules are the only ones you need.

Rule 1: standard, everyday old-fashioned "NAT when going out to the Internet" rule
Rule 2: "hairpin rule" - if redirecting from 192.168.4.X hosts to a destination of 192.168.4.253, then you need this rule so that the replies from 4.253 will be sent to the router to get mapped back to whatever reply IP the original 4.X host was expecting.
Rule 3: this rule redirects port 80 to go to 4.253 for any possible destination, unless the request is actually coming from 4.253 itself.

You do not need any more rules than this to do what you've specified: redirect ALL web to 4.253 and allow it to work from 4.x network.
(5.x network does not require hairpin NAT since it's in a different network entirely from 4.x)
I also want any device in .5.x network to go to my server at 192.168.4.253 irrespective of what website they want to go to.

PS how does the router use these tables does it use all the rules and then send packets or does it sends the packet once it finds a rule correct.
 
User avatar
ZeroByte
Forum Guru
Forum Guru
Posts: 4051
Joined: Wed May 11, 2011 6:08 pm

Re: NAT not working

Thu Aug 11, 2016 7:36 pm

I also want any device in .5.x network to go to my server at 192.168.4.253 irrespective of what website they want to go to.
I know.

The three rules I gave you will do that.
Rule #3 does not care what IP addresses are used, except that the source is NOT 192.168.4.253.
PS how does the router use these tables does it use all the rules and then send packets or does it sends the packet once it finds a rule correct.
The way rule chains work in Mikrotik is that a packet is compared to each rule in order from first until last.
Every condition on the rule MUST be true in order for the rule to match.
If the rule is a match, then the action is done, and the packet leaves the chain (no more rules are checked).
If the rule is not a match, then it continues until the end of the chain.
If no rules match, then the packet will be accepted (filter table default) and will not have any nat actions performed on it (nat table default)


Different chains are used in different parts of the flow of packets - the full picture is shown in the RouterOSv6 Packet Flow Diagram.
Simplified version is this:
input chain = packets to the Router itself
output chain = packets the router generates itself
forward chain = packets flowing through the router - i.e. neither the source nor the destination is the router itself.
srcnat = done after forwarding decisions are made / forward filter
dstnat = done before forwarding decisions are made / forward filter
When given a spoon,
you should not cling to your fork.
The soup will get cold.
 
tatsugot
just joined
Topic Author
Posts: 22
Joined: Tue Jul 26, 2016 8:16 pm

Re: NAT not working

Thu Aug 11, 2016 7:43 pm

I also want any device in .5.x network to go to my server at 192.168.4.253 irrespective of what website they want to go to.

PS how does the router use these tables does it use all the rules and then send packets or does it sends the packet once it finds a rule correct.
I know.

The three rules I gave you will do that.
Rule #3 does not care what IP addresses are used, except that the source is NOT 192.168.4.253.

The way rule chains work in Mikrotik is that a packet is compared to each rule in order from first until last.
Every condition on the rule MUST be true in order for the rule to match.
If the rule is a match, then the action is done, and the packet leaves the chain (no more rules are checked).
If the rule is not a match, then it continues until the end of the chain.
If no rules match, then the packet will be accepted (filter table default) and will not have any nat actions performed on it (nat table default)


Different chains are used in different parts of the flow of packets - the full picture is shown in the RouterOSv6 Packet Flow Diagram.
Simplified version is this:
input chain = packets to the Router itself
output chain = packets the router generates itself
forward chain = packets flowing through the router - i.e. neither the source nor the destination is the router itself.
srcnat = done after forwarding decisions are made / forward filter
dstnat = done before forwarding decisions are made / forward filter
Thanks

Who is online

Users browsing this forum: No registered users and 31 guests