Community discussions

MikroTik App
 
B0Besh
just joined
Topic Author
Posts: 3
Joined: Sun Sep 10, 2017 12:05 pm

Source NAT on VLAN interface

Thu Sep 15, 2022 3:59 pm

Hello all,
I've got simple setup on CRS309 with Vlan1 ports assigned as LAN and Vlan2 port as WAN for internet connection. I am trying to do src NAT on Vlan2 towards my provider but when I do masquerade with output interface Vlan2 it doesn't appear to work. Am I missing something?
Here is my config
/interface bridge
add ingress-filtering=no name=bridge protocol-mode=none vlan-filtering=yes
/interface vlan
add interface=bridge name=vlan1 vlan-id=1
add interface=bridge name=vlan2 vlan-id=2
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list
add name=WAN
add name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=DATA ranges=192.168.89.10-192.168.89.254
/ip dhcp-server
add address-pool=DATA interface=vlan1 lease-time=12h name=DATA_DHCP
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge edge=yes ingress-filtering=no interface=ether1
add bridge=bridge interface=sfp-sfpplus1 pvid=2
add bridge=bridge edge=yes ingress-filtering=no interface=sfp-sfpplus2
add bridge=bridge edge=yes frame-types=admit-only-untagged-and-priority-tagged interface=sfp-sfpplus3
add bridge=bridge edge=yes frame-types=admit-only-untagged-and-priority-tagged interface=sfp-sfpplus4
add bridge=bridge edge=yes frame-types=admit-only-untagged-and-priority-tagged interface=sfp-sfpplus5
add bridge=bridge edge=yes frame-types=admit-only-untagged-and-priority-tagged interface=sfp-sfpplus6
add bridge=bridge edge=yes frame-types=admit-only-untagged-and-priority-tagged interface=sfp-sfpplus7
add bridge=bridge edge=yes frame-types=admit-only-untagged-and-priority-tagged interface=sfp-sfpplus8
/ip neighbor discovery-settings
set discover-interface-list=all
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge tagged=bridge vlan-ids=1
add bridge=bridge tagged=bridge vlan-ids=2
/interface list member
add interface=vlan2 list=WAN
add interface=vlan1 list=LAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.89.1/24 interface=vlan1 network=192.168.89.0
/ip dhcp-client
add interface=vlan2
/ip dhcp-server network
add address=192.168.89.0/24 dns-server=192.168.1.1 gateway=192.168.89.1
/ip firewall filter
add action=fasttrack-connection chain=forward connection-nat-state="" connection-state=established,related hw-offload=yes
add action=accept chain=forward connection-nat-state=srcnat,dstnat connection-state=established,related,new,untracked
/ip firewall nat
add action=masquerade chain=srcnat out-interface=vlan2
/routing igmp-proxy
set quick-leave=yes
/system clock
set time-zone-name=Europe/Bratislava
/system identity
set name=HomeRTR
/system routerboard settings
set boot-os=router-os
Thanks for your help!
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19103
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Source NAT on VLAN interface

Thu Sep 15, 2022 8:54 pm

The bridge normally does not involve your WAN connection. Is it a public IP or private IP. What type of WAn provision pppoe, vlan etc.............
Dont use vlan1 ID for anything on MT, as its a default vlan-id the bridge uses in the background, just creates a mess later on.
So vlan2 and above is fine...............

Suggest you look at para C. and read the recommended link and info - viewtopic.php?t=182373
 
B0Besh
just joined
Topic Author
Posts: 3
Joined: Sun Sep 10, 2017 12:05 pm

Re: Source NAT on VLAN interface

Thu Sep 15, 2022 9:45 pm

Thanks, so you suggest to take that Vlan2 off the bridge and use other Vlan instead of 1?
Provider uses private IP assigned by DHCP and then 1to1 NAT to public. Also it's triple play so I would need to assign 2 more Vlans to WAN interface that are tagged. Data traffic in Vlan2 will be untagged.
Is L3 hw offloading going to work if I take that Vlan2 off the bridge?

Thanks again, i'll go through para C.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19103
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Source NAT on VLAN interface

Thu Sep 15, 2022 10:01 pm

If you have a complicated wan setup, best to provide a diagram and use real numbers except for any public IP information.
Not sure how you can get a public IP from a private IP makes little sense to me,
But before we do more with the config best to fully understand your scenario.
 
B0Besh
just joined
Topic Author
Posts: 3
Joined: Sun Sep 10, 2017 12:05 pm

Re: Source NAT on VLAN interface

Fri Sep 16, 2022 12:12 pm

Seems like I found the issue.
Looks like I wasn't following L3HW offload tutorial properly. Needed to disable l3-hw-offloading on uplink port. After that all works now.
https://help.mikrotik.com/docs/display/ ... rewall/NAT
/interface/ethernet/switch/port set sfp-sfpplus1 l3-hw-offloading=no
Now I need to set up some basic FW rules, any suggestions? Follow your tutorial?

Thanks
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19103
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Source NAT on VLAN interface

Fri Sep 16, 2022 1:32 pm

Yup, then you can build on that for what you need to allow any special traffic.

Who is online

Users browsing this forum: No registered users and 53 guests