Hello guys, please give me a hand on this one.
How can I configure PAT on the Mikrotik? I'm not talking about one to many setups, but I want Mikrotik not only to translate private IP addresses into one public but also change source ports.
Example:
Src: 172.16.0.3:52324 Dest: 200.1.0.1:443
Normally what Mikrotik would do is translate 172.x.x.x into 108.100.0.43:52324
I want the source port also to be changed compared to the 172.x.x.x source port.
For instance:
172.16.0.3:52324 - 108.100.0.43:42523 - 200.1.0.1:443
Thank you!
Re: NAT overload
For port forwarding normally you need three things.
a. one firewall rule (forward chain) that allows dst-nat coming in from the WAN side.
b. source nat rule outbound (default rule usually good)
c. the dstnat rule.
C. is where you need to concentrate your efforts.
Here is where you put in the details of the port forwarding including limiting it perhaps (recommended) to a only known external IPs, and as well what you are asking about which is port translation.
Typical rule.
add chain=dstnat action=dst-nat dst-address=WANIP (if static) dst-port=8989 protocol=tcp \
to-addresses=IPofServer to-ports=25560
If the to-port (on the server) is the same as the destination port, then one doesnt have to even state the to-port as it is implied.
In our case the external user points his traffic at the router on port 8989 and the router translates this to port 25560 before the traffic hits the server.
a. one firewall rule (forward chain) that allows dst-nat coming in from the WAN side.
b. source nat rule outbound (default rule usually good)
c. the dstnat rule.
C. is where you need to concentrate your efforts.
Here is where you put in the details of the port forwarding including limiting it perhaps (recommended) to a only known external IPs, and as well what you are asking about which is port translation.
Typical rule.
add chain=dstnat action=dst-nat dst-address=WANIP (if static) dst-port=8989 protocol=tcp \
to-addresses=IPofServer to-ports=25560
If the to-port (on the server) is the same as the destination port, then one doesnt have to even state the to-port as it is implied.
In our case the external user points his traffic at the router on port 8989 and the router translates this to port 25560 before the traffic hits the server.