Limit Interface to Specific IP from Address List

CurtisS · Wed Oct 05, 2022 7:26 pm

I have a range of public IPs (e.g. 112.122.132.4-112.122.132.14) specified in an address list and tagged to the the WAN interface:

IP > Addresses

 
 1   112.122.132.12/28   112.122.132.0    sfp-sfpplus12
...
20   112.122.132.11/28   112.122.132.0    sfp-sfpplus12
21   112.122.132.10/28   112.122.132.0    sfp-sfpplus12
22   112.122.132.4/28    112.122.132.0    sfp-sfpplus12
23   112.122.132.5/28    112.122.132.0    sfp-sfpplus12
24   112.122.132.6/28    112.122.132.0    sfp-sfpplus12
25   112.122.132.7/28    112.122.132.0    sfp-sfpplus12
26   112.122.132.8/28    112.122.132.0    sfp-sfpplus12
27   112.122.132.9/28    112.122.132.0    sfp-sfpplus12

We'd like to use 112.122.132.12 as our public IP address but whenever the router is rebooted, that interface always chooses 112.122.132.4 (I'm assuming it's choosing the first address in that range). Is there a way to set a priority on the addresses in the list or somehow force the interface to always use a specific IP from that list?

rextended · Wed Oct 05, 2022 7:43 pm

You didn't specify what else is configured, so the only thing I can assume is...

For me there is no logical reason to assign all those addresses in the same range to a single interface.
One is enough.
If you want to NAT other IPs on other ports, the IP does not need to be already assigned to one interface, it is already routed to the Router...

Returning to the initial request, you must select the preferred-source in the default route.

sindy · Wed Oct 05, 2022 7:55 pm

What exactly means that the interface "chooses" 112.122.132.4? That an action=masquerade rule assigns that address as the new source one to outgoing connections from LAN clients, and/or that outgoing traffic of the router itself uses that address?

sindy · Wed Oct 05, 2022 8:06 pm

For me there is no logical reason to assign all those addresses in the same range to a single interface.
One is enough.
If you want to NAT other IPs on other ports, the IP does not need to be already assigned to one interface, it is already routed to the Router...

Except if the gateway router is in the same /28 and thus sends an ARP request for all addresses from that subnet. /ip arp add publish=yes doesn't help here.

CurtisS · Wed Oct 05, 2022 8:46 pm

@rextended thanks for the quick reply!

You didn't specify what else is configured...

Sorry, I'm relatively new/inexperienced with Mikrotik. If there's more information that would be helpful, please let me know and I will try to provide it. And I inherited this Mikrotik config so I'm not sure why it is configured the way it is.

For me there is no logical reason to assign all those addresses in the same range to a single interface.
One is enough.
If you want to NAT other IPs on other ports, the IP does not need to be already assigned to one interface, it is already routed to the Router...

Interesting. Looking at the NAT rules, there are entries that use 112.122.132.9 and 112.122.132.10 as their Dst. Address. But you're saying that those addresses don't need to be in the address list for that to work?

Returning to the initial request, you must select the preferred-source in the default route.

Looking in IP > Routes, I see this:

#           DST_ADDRESS    PREF-SRC          GATEWAY                 DISTANCE
...
5 ADC  112.122.132.0/28    112.122.132.12   sfp-sfpplus12             0
...

Is there a different place to specify the preferred source?

CurtisS · Wed Oct 05, 2022 8:59 pm

@sindy

What exactly means that the interface "chooses" 112.122.132.4?

I'm not sure, but I believe that outgoing traffic of the router itself uses that address. For example, if I check whatismyip.com, it reports the 112.122.132.4 address. If I temporarily disable the .4-.11 addresses in the address list and check the public IP again, it reports the .12 address.

CurtisS · Wed Oct 05, 2022 9:10 pm

I noticed @sindy's signature so I'm posting my config in hopes that helps clarify things.

# oct/05/2022 10:50:00 by RouterOS 6.49.6
# software id = LGM4-DTDZ
#
# model = CCR2004-1G-12S+2XS
# serial number = D4F10CA1207B
/interface bridge
add name=bridge1 vlan-filtering=yes
add disabled=yes name=bridge1065 pvid=1065 \
    vlan-filtering=yes
add name=vpn_bridge
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full,10000M-full
set [ find default-name=sfp-sfpplus3 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full,10000M-full
set [ find default-name=sfp-sfpplus5 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full,10000M-full
set [ find default-name=sfp-sfpplus11 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full,10000M-full
/interface vrrp
add disabled=yes interface=sfp-sfpplus1 name=vrrp1 priority=200
/interface vlan
add interface=sfp-sfpplus1 name=vlan101 vlan-id=101
add interface=sfp-sfpplus1 name=vlan102 vlan-id=102
add interface=sfp-sfpplus1 name=vlan103 vlan-id=103
add interface=sfp-sfpplus1 name=vlan104 vlan-id=104
add interface=sfp-sfpplus3 name=vlan201 vlan-id=201
add interface=sfp-sfpplus3 name=vlan301 vlan-id=301
add interface=sfp-sfpplus9 name=vlan1010 vlan-id=1010
add interface=sfp-sfpplus11 name=vlan1044_SAN vlan-id=1044
add interface=sfp-sfpplus9 name=vlan1046_OSInternal vlan-id=1046
add interface=sfp-sfpplus11 name=vlan1047_Servers vlan-id=1047
add interface=sfp-sfpplus9 name=vlan1048_OSServers vlan-id=1048
add interface=sfp-sfpplus9 name=vlan1049_IPMI vlan-id=1049
add interface=sfp-sfpplus3 name=vlan1064 vlan-id=1064
add interface=sfp-sfpplus3 name=vlan1065 vlan-id=1065
add interface=sfp-sfpplus1 name=vlan1066 vlan-id=1066
add interface=sfp-sfpplus11 name=vlan1067Server_mgmt vlan-id=1067
add interface=sfp-sfpplus9 name=vlan1068_OpenStackSwitch vlan-id=1068
/interface vrrp
add disabled=yes interface=vlan101 name=vrrp101
add disabled=yes interface=vlan102 name=vrrp102
add disabled=yes interface=vlan103 name=vrrp103
add disabled=yes interface=vlan104 name=vrrp104
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-192,aes-128,3des
add dh-group=modp1024 enc-algorithm=aes-256,aes-192,aes-128,3des name=\
    profile1
add dh-group=modp1024 dpd-interval=10s dpd-maximum-failures=3 enc-algorithm=\
    aes-128 lifetime=8h name=Amazon
/ip ipsec peer
add address=54.201.30.69/32 local-address=my.public.ip.12 name=AmazonVPC2 \
    profile=Amazon
add address=34.210.124.60/32 local-address=my.public.ip.12 name=AmazonVPC \
    profile=Amazon
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=\
    aes-256-cbc,aes-192-cbc,aes-128-cbc,3des
add enc-algorithms=aes-128-cbc lifetime=1h name=ipsec-vpn-070053c6ddad646ce-0
add enc-algorithms=aes-128-cbc lifetime=1h name=ipsec-vpn-070053c6ddad646ce-1
/ip pool
add name=pool101 ranges=\
    192.168.128.11-192.168.131.254
add name=pool102 ranges=\
    192.168.136.11-192.168.139.254
add name=pool103 ranges=\
    192.168.144.11-192.168.147.254
add name=pool104 ranges=\
    192.168.152.11-192.168.155.254
add name=pool301 ranges=192.168.168.2-192.168.171.254
add name=pool201 ranges=192.168.160.3-192.168.163.254
add name=VPNPOOL ranges=192.168.32.2-192.168.32.254
/ip dhcp-server
add address-pool=pool101 disabled=no interface=vlan101 lease-time=23h59m \
    name=server101
add address-pool=pool102 disabled=no interface=vlan102 lease-time=23h59m \
    name=server102
add address-pool=pool103 disabled=no interface=vlan103 lease-time=23h59m \
    name=server103
add address-pool=pool104 disabled=no interface=vlan104 lease-time=23h59m \
    name=server104
add address-pool=pool201 disabled=no interface=vlan201 lease-script=\
    internal_Wifi lease-time=23h59m name=server201 src-address=192.168.160.1
add address-pool=pool301 disabled=no interface=vlan301 lease-script=\
    Guest_WiFi lease-time=1h name=server301 src-address=192.168.168.1
/ppp profile
set *0 change-tcp-mss=default wins-server=192.168.5.40
add dns-server=192.168.5.40 local-address=192.168.32.1 name=vpn_profile \
    remote-address=VPNPOOL use-encryption=yes wins-server=192.168.5.40
/queue tree
add disabled=yes max-limit=3G name=Download parent=global priority=1 queue=\
    pcq-download-default
add disabled=yes limit-at=2500M max-limit=3G name=user-down packet-mark=user \
    parent=Download priority=5 queue=pcq-download-default
add disabled=yes limit-at=2500M max-limit=3G name=server-down packet-mark=\
    server-down parent=Download priority=3 queue=pcq-download-default
add disabled=yes limit-at=5M max-limit=5M name=voip-down packet-mark=voip \
    parent=Download priority=2 queue=pcq-download-default
/routing bgp instance
set default as=65016 client-to-client-reflection=no redistribute-connected=\
    yes redistribute-static=yes router-id=my.public.ip.12
add as=65000 client-to-client-reflection=no name=AWSVPC1 \
    redistribute-connected=yes redistribute-static=yes router-id=\
    169.254.175.170
add as=65000 client-to-client-reflection=no disabled=yes name=AWSVPC2 \
    redistribute-connected=yes redistribute-static=yes router-id=\
    169.254.157.34
/snmp community
set [ find default=yes ] disabled=yes
add addresses=192.168.8.124/32 authentication-protocol=SHA1 \
    encryption-protocol=AES name=lightcast security=private
/system logging action
set 3 remote=192.168.5.71 remote-port=10514 src-address=192.168.5.1
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
    sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge nat
add action=accept chain=srcnat
/interface bridge port
add bridge=bridge1 interface=sfp-sfpplus3
add bridge=bridge1 interface=sfp-sfpplus4
add bridge=bridge1 interface=sfp-sfpplus5
add bridge=bridge1 interface=sfp-sfpplus6
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add disabled=yes tagged=sfp-sfpplus3,sfp-sfpplus4,sfp-sfpplus5,sfp-sfpplus6 \
    vlan-ids=1064
add bridge=bridge1 disabled=yes tagged=sfp-sfpplus3 vlan-ids=201
add bridge=bridge1 disabled=yes tagged=sfp-sfpplus3 vlan-ids=301
/interface l2tp-server server
set default-profile=vpn_profile enabled=yes use-ipsec=yes
/ip address
add address=192.168.88.1/24 interface=ether1 network=\
    192.168.88.0
add address=my.public.ip.12/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=192.168.64.10/24 disabled=yes network=192.168.64.0
add address=192.168.64.1/24 disabled=yes interface=vrrp1 network=192.168.64.0
add address=192.168.128.1/22 interface=\
    vlan101 network=192.168.128.0
add address=192.168.136.1/22 interface=\
    vlan102 network=192.168.136.0
add address=192.168.144.1/22 interface=\
    vlan103 network=192.168.144.0
add address=192.168.152.1/22 interface=\
    vlan104 network=192.168.152.0
add address=192.168.168.1/22 disabled=yes network=\
    192.168.168.0
add address=192.168.65.1/24 interface=vlan1065 network=192.168.65.0
add address=192.168.160.1/22 disabled=yes network=192.168.160.0
add address=192.168.168.1/22 disabled=yes network=192.168.168.0
add address=192.168.160.1/22 interface=\
    vlan201 network=192.168.160.0
add address=192.168.168.1/22 interface=\
    vlan301 network=192.168.168.0
add address=192.168.64.1/24 interface=\
    vlan1064 network=192.168.64.0
add address=192.168.32.1/24 interface=vpn_bridge \
    network=192.168.32.0
add address=192.168.66.1/24 interface=\
    vlan1066 network=192.168.66.0
add address=192.168.5.1/24 interface=\
    vlan1047_Servers network=192.168.5.0
add address=192.168.67.1/24 interface=\
    vlan1067Server_mgmt network=192.168.67.0
add address=10.44.44.2/24 interface=\
    vlan1044_SAN network=10.44.44.0
add address=my.public.ip.11/28 interface=\
    sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.10/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.4/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.5/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.6/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.7/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.8/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=my.public.ip.9/28 interface=sfp-sfpplus12 network=my.public.ip.0
add address=169.254.175.170/30 interface=sfp-sfpplus12 network=\
    169.254.175.168
add address=169.254.157.34/30 interface=sfp-sfpplus12 network=169.254.157.32
add address=192.168.68.1/24 interface=\
    vlan1068_OpenStackSwitch network=192.168.68.0
add address=192.168.7.1/24 interface=\
    vlan1049_IPMI network=192.168.7.0
add address=192.168.8.1/22 interface=\
    vlan1046_OSInternal network=192.168.8.0
add address=10.10.10.1/24 interface=\
    vlan1010 network=10.10.10.0
add address=my.public.ip.33/27 interface=\
    vlan1048_OSServers network=my.public.ip.32
add address=my.public.ip.32 disabled=yes interface=vlan1048_OSServers network=\
    my.public.ip.32
/ip dhcp-server lease
add address=192.168.160.2 client-id=1:b4:fb:e4:2a:4a:11 mac-address=\
    B4:FB:E4:2A:4A:11 server=server201
/ip dhcp-server network
add address=192.168.128.0/22 dns-server=192.168.5.40 gateway=192.168.128.1 \
    netmask=22
add address=192.168.136.0/24 dns-server=192.168.5.40 gateway=192.168.136.1 \
    netmask=22
add address=192.168.144.0/22 dns-server=192.168.5.40 gateway=192.168.144.1 \
    netmask=24
add address=192.168.152.0/22 dns-server=192.168.5.40 gateway=192.168.152.1 \
    netmask=22
add address=192.168.160.0/22 dns-server=192.168.5.40 gateway=192.168.160.1 \
    netmask=22
add address=192.168.168.0/22 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.168.1 \
    netmask=22
/ip dns
set servers=192.168.5.40,172.16.1.1
/ip firewall address-list
add address=192.168.128.0/22 list=users
add address=192.168.136.0/22 list=users
add address=192.168.144.0/22 list=users
add address=192.168.152.0/22 list=users
add address=192.168.32.0/24 list=users
add address=192.168.5.0/24 list=servers
add address=63.247.65.242 list=netdepot
add address=65.254.34.186 list=netdepot
add address=66.248.200.0/22 list=sucuri
add address=185.93.228.0/22 list=sucuri
add address=192.88.134.0/23 list=sucuri
add address=my.public.ip.0/28 list=servers
add address=192.168.160.0/22 list=users
add address=192.168.168.0/22 list=guests
add address=192.168.65.0/24 list=cameras
add address=192.168.66.0/24 list=Routers
add address=10.44.44.0/24 list=servers
add address=192.168.65.2 list=users
add address=192.168.65.3 list=users
add address=192.168.65.0/24 list=Routers
add address=192.168.67.0.24 list=Routers
add address=192.168.68.0/24 list=Routers
add address=192.168.65.2 list=johnson_list
add address=192.168.65.3 list=johnson_list
add address=192.168.65.4 list=johnson_list
add address=192.168.65.5 list=johnson_list
add address=192.168.8.0/22 list=servers
add address=192.168.7.0/24 list=IPMI
add address=192.168.8.0/22 list=OpenStack
add address=192.168.33.3 list=users
add address=192.168.7.11 list=Routers
add address=192.168.7.12 list=Routers
add address=10.10.10.0/24 list=OpenStack
add address=10.10.10.0/24 list=servers
add address=my.public.ip.32/27 list=OpenStackPublic
/ip firewall filter
add action=accept chain=forward comment=established,related connection-state=\
    established,related
add action=accept chain=input dst-port=500,1701,4500,450 \
    protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=forward connection-state=related
add action=accept chain=forward src-address-list=cameras
add action=accept chain=input src-address-list=cameras
add action=accept chain=forward src-address-list=users
add action=accept chain=input src-address-list=users
add action=accept chain=forward src-address-list=Routers
add action=accept chain=input src-address-list=Routers
add action=accept chain=input src-address-list=servers
add action=accept chain=forward src-address-list=servers
add action=accept chain=forward disabled=yes in-interface=all-vlan \
    out-interface=all-vlan
add action=accept chain=input dst-port=53 protocol=udp \
    src-address-list=guests
add action=accept chain=forward src-address-list=guests
add action=accept chain=forward src-address=10.49.49.0/24
add action=accept chain=forward dst-address-list=OpenStackPublic
add action=accept chain=forward src-address-list=OpenStackPublic
add action=accept chain=input disabled=yes dst-address-list=OpenStackPublic
add action=accept chain=input disabled=yes src-address-list=OpenStackPublic
add action=accept chain=forward disabled=yes src-address-list=netdepot
add action=accept chain=forward dst-address-list=johnson_list\
    src-address=192.168.33.2
add action=accept chain=input dst-address-list=johnson_list src-address=\
    192.168.33.2
add action=accept chain=forward src-address=192.168.33.3
add action=accept chain=input dst-address-list=IPMI src-address=192.168.33.3
add action=accept chain=forward dst-address-list=OpenStack src-address=\
    192.168.33.3
add action=accept chain=input dst-address-list=OpenStack src-address=\
    192.168.33.3
add action=accept chain=forward dst-address=192.168.68.0/24 src-address=\
    192.168.33.3
add action=accept chain=input dst-address=192.168.68.0/24 src-address=\
    192.168.33.3
add action=drop chain=forward dst-address=192.168.5.0/24 src-address=\
    192.168.33.3
add action=drop chain=forward dst-address=192.168.65.0/24 src-address=\
    192.168.33.3
add action=drop chain=forward dst-address=192.168.66.0/24 src-address=\
    192.168.33.0/24
add action=drop chain=forward dst-address=192.168.67.0/24 src-address=\
    192.168.33.0/24
add action=drop chain=forward dst-address=192.168.128.0/22 src-address=\
    192.168.33.0/24
add action=drop chain=forward dst-address=192.168.136.0/22 src-address=\
    192.168.33.0/24
add action=drop chain=forward dst-address=192.168.144.0/22 src-address=\
    192.168.33.0/24
add action=drop chain=forward dst-address=192.168.152.0/22 src-address=\
    192.168.33.0/24
add action=drop chain=forward dst-address=192.168.160.0/22 src-address=\
    192.168.33.0/24
add action=return chain=servers comment="return to fwd chain" disabled=yes
add action=accept chain=forward comment=icmp icmp-options=8:0 protocol=icmp
add action=accept chain=forward icmp-options=3:0-255 protocol=icmp
add action=accept chain=input disabled=yes protocol=icmp
add action=drop chain=input src-address-list=invalid_login
add action=accept chain=forward comment="working nat" connection-nat-state=\
    dstnat
add action=accept chain=input comment="established, related" \
    connection-state=established,related
add action=accept chain=input connection-state=related disabled=yes
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input comment=core src-address=10.49.49.0/24
add action=accept chain=input comment=icmp protocol=icmp
add action=accept chain=input comment=winbox dst-port=8291 in-interface=\
    !sfp-sfpplus12 protocol=tcp
add action=accept chain=input comment=ssh dst-port=5022 in-interface=\
    !sfp-sfpplus12 protocol=tcp
add action=log chain=input disabled=yes
add action=accept chain=input disabled=yes dst-port="" protocol=tcp \
    src-address=192.188.180.15 src-port=443,8443
add action=add-src-to-address-list address-list=invalid_login \
    address-list-timeout=30m chain=input comment=\
    "Tiered \"fail2ban\" for invalid_logins" connection-state=new dst-port=\
    8291 protocol=tcp src-address-list=login_stage_3
add action=add-src-to-address-list address-list=login_stage_3 \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    protocol=tcp src-address-list=login_stage_2
add action=add-src-to-address-list address-list=login_stage_2 \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    protocol=tcp src-address-list=login_stage_1
add action=add-src-to-address-list address-list=login_stage_1 \
    address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
    protocol=tcp
add action=reject chain=forward comment="default reject" reject-with=\
    icmp-port-unreachable
add action=reject chain=input comment="default reject" reject-with=\
    icmp-port-unreachable
/ip firewall mangle
add action=mark-connection chain=forward comment=voip new-connection-mark=\
    voip-conn passthrough=yes protocol=udp src-port=5060-5099
add action=mark-connection chain=forward new-connection-mark=voip-conn \
    passthrough=yes protocol=tcp src-port=5060-5099
add action=mark-connection chain=forward new-connection-mark=voip-conn \
    passthrough=yes protocol=udp src-port=8000-8200
add action=mark-connection chain=forward new-connection-mark=voip-conn \
    passthrough=yes protocol=tcp src-port=8801-8802
add action=mark-connection chain=forward dscp=46 new-connection-mark=\
    voip-conn passthrough=yes protocol=udp src-port=16384-65535
add action=mark-packet chain=prerouting connection-mark=voip-conn \
    new-packet-mark=voip passthrough=no
add action=mark-packet chain=forward connection-mark=user-conn \
    new-packet-mark=user passthrough=no
add action=mark-routing chain=prerouting new-routing-mark=\
    fsr-backup passthrough=no src-address-list=fsr
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes dst-address=10.10.112.47 \
    src-address=192.168.160.0/22
add action=accept chain=srcnat dst-address=\
    169.254.175.169 src-address=169.254.175.170
add action=accept chain=srcnat dst-address=\
    169.254.157.33 src-address=169.254.157.34
add action=accept chain=srcnat dst-address=\
    172.30.0.0/16 src-address=192.168.5.0/24
add action=accept chain=srcnat dst-address=\
    192.168.5.0/24 src-address=172.30.0.0/16
add action=accept chain=srcnat dst-address=\
    172.30.0.0/16 src-address=192.168.144.0/22
add action=accept chain=srcnat dst-address=172.30.0.0/16 src-address=\
    192.168.8.0/22
add action=accept chain=srcnat dst-address=192.168.8.0/22 src-address=\
    172.30.0.0/16
add action=accept chain=srcnat dst-address=172.30.0.0/16 src-address=\
    my.public.ip.32/27
add action=accept chain=srcnat dst-address=my.public.ip.32/27 src-address=\
    172.30.0.0/16
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.40 \
    src-address=172.16.0.0/16
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.40 \
    src-address=192.168.5.0/24
add action=masquerade chain=srcnat disabled=\
    yes dst-address=192.168.9.249 src-address=192.168.5.0/24
add action=masquerade chain=srcnat dst-address=192.168.5.18 src-address=\
    172.16.0.0/16
add action=masquerade chain=srcnat dst-address=192.168.5.18 out-interface=\
    sfp-sfpplus12 src-address-list=users
add action=dst-nat chain=dstnat dst-address=my.public.ip.8 src-address-list=\
    users to-addresses=192.168.5.18
add action=masquerade chain=srcnat dst-address=192.168.5.18 src-address=\
    192.168.5.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.42 \
    src-address=172.16.0.0/16
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.42 \
    src-address=192.168.5.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.25 \
    src-address=172.16.0.0/16
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.25 \
    src-address=192.168.5.0/24
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.66 \
    src-address=172.16.0.0/16
add action=masquerade chain=srcnat disabled=yes dst-address=192.168.5.66 \
    src-address=192.168.5.0/24
add action=masquerade chain=srcnat dst-address=\
    192.168.5.37 src-address=172.16.0.0/16
add action=masquerade chain=srcnat dst-address=192.168.5.37 src-address=\
    192.168.5.0/24
add action=masquerade chain=srcnat out-interface=\
    sfp-sfpplus12
add action=masquerade chain=srcnat dst-address=\
    192.168.5.80 src-address=172.16.0.0/16
add action=masquerade chain=srcnat dst-address=192.168.5.80 src-address=\
    192.168.5.0/24
add action=src-nat chain=srcnat src-address=192.168.5.80 \
    to-addresses=my.public.ip.9
add action=dst-nat chain=dstnat dst-address=\
    my.public.ip.9 dst-port=10051 protocol=tcp to-addresses=172.16.1.1
add action=dst-nat chain=dstnat dst-address=\
    my.public.ip.10 dst-port=80,443,990,5022,7000-7009 protocol=tcp \
    to-addresses=192.168.5.40
add action=dst-nat chain=dstnat disabled=\
    yes dst-address=my.public.ip.11 dst-port=21,80,443,5022,7000-7009 protocol=\
    tcp to-addresses=192.168.8.90
add action=src-nat chain=srcnat disabled=yes src-address=\
    192.168.5.42 to-addresses=my.public.ip.4
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.4 \
    src-address=172.16.1.1 to-addresses=192.168.5.42
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.4 \
    dst-port=80,443,5022 protocol=tcp to-addresses=192.168.5.42
add action=src-nat chain=srcnat disabled=yes src-address=192.168.5.25\
    to-addresses=my.public.ip.6
add action=src-nat chain=srcnat disabled=yes dst-address=207.210.70.162 \
    src-address=192.168.5.25 to-addresses=my.public.ip.6
add action=src-nat chain=srcnat disabled=yes dst-address=63.247.65.143 \
    src-address=192.168.5.25 to-addresses=my.public.ip.6
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    src-address=207.210.70.162 to-addresses=192.168.5.25
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    src-address=63.247.65.146 to-addresses=192.168.5.25
add action=src-nat chain=srcnat disabled=yes dst-address=44.225.58.100 \
    protocol=tcp src-address=192.168.5.25 src-port=3306 to-addresses=\
    my.public.ip.6
add action=src-nat chain=srcnat disabled=yes dst-address=54.208.175.103 \
    protocol=tcp src-address=192.168.5.25 src-port=3306 to-addresses=\
    my.public.ip.6
add action=src-nat chain=srcnat disabled=yes dst-address=3.212.168.141 \
    protocol=tcp src-address=192.168.5.25 src-port=3306 to-addresses=\
    my.public.ip.6
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    dst-port=3306 protocol=tcp src-address=44.225.58.100 to-addresses=\
    192.168.5.25
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    dst-port=3306 protocol=tcp src-address=54.208.175.103 to-addresses=\
    192.168.5.25
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    dst-port=3306 protocol=tcp src-address=3.212.168.142 to-addresses=\
    192.168.5.25
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    dst-port=53 protocol=udp to-addresses=192.168.5.25
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.6 \
    dst-port=53,80,443,5022 protocol=tcp to-addresses=192.168.5.25
add action=src-nat chain=srcnat to-addresses=my.public.ip.7
add action=dst-nat chain=dstnat dst-address=my.public.ip.7 dst-port=\
    80,443,5005,5008 protocol=tcp to-addresses=192.168.5.37
add action=src-nat chain=srcnat disabled=yes dst-address=44.228.108.208\
    protocol=tcp src-address=192.168.5.18 src-port=3306 \
    to-addresses=my.public.ip.8
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.8 \
    dst-port=3306 protocol=tcp src-address=44.228.108.208 to-addresses=\
    192.168.5.18
add action=dst-nat chain=dstnat disabled=yes \
    dst-address=my.public.ip.8 dst-port=80 protocol=tcp to-addresses=\
    192.168.5.48 to-ports=8088
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.8 \
    dst-port=443 protocol=tcp to-addresses=192.168.5.48 to-ports=4443
add action=src-nat chain=srcnat disabled=yes \
    src-address=192.168.5.66 to-addresses=my.public.ip.5
add action=src-nat chain=srcnat disabled=yes dst-address=74.81.91.18 \
    src-address=192.168.5.66 to-addresses=my.public.ip.5
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.5 \
    src-address=74.81.91.18 to-addresses=192.168.5.66
add action=dst-nat chain=dstnat disabled=yes dst-address=my.public.ip.5 \
    dst-port=80,443,5022 protocol=tcp to-addresses=192.168.5.66
add action=masquerade chain=srcnat dst-address=192.168.64.0/24 src-address=192.168.32.0/24
add action=masquerade chain=srcnat dst-address=192.168.66.0/24 src-address=\
    192.168.32.0/24
/ip ipsec identity
add peer=AmazonVPC2
add peer=AmazonVPC
/ip ipsec policy
add dst-address=172.30.0.0/16 peer=AmazonVPC proposal=\
    ipsec-vpn-070053c6ddad646ce-0 src-address=192.168.5.0/24 tunnel=yes
add dst-address=169.254.175.169/32 peer=AmazonVPC proposal=\
    ipsec-vpn-070053c6ddad646ce-0 src-address=169.254.175.170/32 tunnel=yes
add dst-address=172.30.0.0/16 peer=AmazonVPC proposal=\
    ipsec-vpn-070053c6ddad646ce-0 src-address=192.168.144.0/22 tunnel=yes
add dst-address=169.254.157.33/32 peer=AmazonVPC2 proposal=\
    ipsec-vpn-070053c6ddad646ce-1 src-address=169.254.157.34/32 tunnel=yes
add disabled=yes dst-address=172.30.0.0/16 peer=AmazonVPC2 proposal=\
    ipsec-vpn-070053c6ddad646ce-1 src-address=192.168.5.0/24 tunnel=yes
add dst-address=172.30.0.0/16 peer=AmazonVPC proposal=\
    ipsec-vpn-070053c6ddad646ce-0 src-address=192.168.8.0/22 tunnel=yes
add dst-address=172.30.0.0/16 peer=AmazonVPC proposal=\
    ipsec-vpn-070053c6ddad646ce-0 src-address=my.public.ip.32/27 tunnel=yes
/ip route
add distance=1 gateway=my.public.ip.1 pref-src=my.public.ip.12
add disabled=yes distance=1 dst-address=\
    10.10.10.0/24 gateway=192.168.68.13
add distance=1 dst-address=10.10.112.0/24 \
    gateway=192.168.128.9
add disabled=yes distance=1 dst-address=my.public.ip.32/28 gateway=\
    vlan1068_OpenStackSwitch
add disabled=yes distance=1 dst-address=192.168.65.0/24 gateway=vlan1065
add distance=1 dst-address=192.168.128.0/22 gateway=vlan101
add distance=1 dst-address=192.168.136.0/22 gateway=vlan102
add distance=1 dst-address=192.168.144.0/22 gateway=vlan103
add distance=1 dst-address=192.168.152.0/22 gateway=vlan104
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=5022
set api disabled=yes
set api-ssl disabled=yes
/ppp aaa
set use-radius=yes
/ppp secret
add disabled=yes name=mwaldorf profile=vpn_profile
add name=inland profile=vpn_profile
add local-address=192.168.33.1 name=johnsoncontrols profile=vpn_profile \
    remote-address=192.168.33.2
add local-address=192.168.33.1 name=vexhost profile=vpn_profile \
    remote-address=192.168.33.3
/radius
add address=192.168.5.80 service=ppp,ipsec timeout=2s
add address=192.168.5.40 service=ppp,ipsec timeout=2s
add address=54.203.27.225 service=ppp,ipsec \
    src-address=my.public.ip.11
add address=18.204.0.31 service=ppp,ipsec \
    src-address=my.public.ip.11
/routing bgp network
add network=192.168.5.0/24 synchronize=no
add network=192.168.144.0/22 synchronize=no
add network=192.168.8.0/22 synchronize=no
add network=my.public.ip.32/27 synchronize=no
/routing bgp peer
add hold-time=30s instance=AWSVPC1 keepalive-time=10s name=\
    BGP-vpn-070053c6ddad646ce-0 remote-address=169.254.175.169 ttl=default
add hold-time=30s instance=AWSVPC2 keepalive-time=10s name=\
    BGP-vpn-070053c6ddad646ce-1 remote-address=169.254.157.33 ttl=default
/snmp
set trap-community=lightcast trap-version=3
/system clock
set time-zone-name=America/Los_Angeles
/system identity
set name=CoreRouter
/system logging
add action=remote topics=info
/tool bandwidth-server
set enabled=no
/tool sniffer
set filter-interface=*24 filter-ip-protocol=udp filter-mac-protocol=0 \
    filter-port=bootpc memory-limit=1000KiB

sindy · Wed Oct 05, 2022 10:31 pm

if I check whatismyip.com, it reports the 112.122.132.4 address.

I assume you don't open the whatismyip.com page from the router itself - you open it from a PC connected to router's LAN. So it is not "own traffic of the router", it is "traffic forwarded by the router". Hence the source address is already assigned to the packets as they arrive to the router, and rules in chain srcnat of table nat handle that traffic and change the source address to one of the ones assigned to the output interface. The behaviour suggests that you have an action=masquerade rule there. And I don't think action=masquerade rule looks at pref-src of a route when choosing the address to assign. Also, unless your action=masquerade rule contains a match condition src-address-type=!local or src-address=!112.122.132.0/28, it assigns a new source address even to packets sent by the router itself, so even though the packets sent by the router itself get a source address depending on pref-src value of the route, the source address is nevertheless changed by the action=masquerade rule.

Since you have the WAN addresses assigned statically, you do not need an action=masquerade rule and can use one or more action=src-nat rules instead. These rules can be fine-tuned to assign source addresses from a pool to particular traffic, as you can specify to-addresses as a prefix or range, such as to-addresses=112.122.132.5-112.122.132.7. And they can also be configured not to act on the own traffic of the router - either as suggested above or by only matching on source addresses of the LAN subnets.

CurtisS · Wed Oct 05, 2022 11:35 pm

I assume you don't open the whatismyip.com page from the router itself - you open it from a PC connected to router's LAN.

That is correct.

It looks like I do have an action=masquerade NAT rule and it doesn't have a match condition:

add action=masquerade chain=srcnat out-interface=sfp-sfpplus12

I'm a novice when it comes to Mikrotik and networking and not super confident in making changes like this so forgive me if the questions below are obvious to more experienced users...

It sounds like you're suggesting changing the NAT rule to something like this?

add action=src-nat chain=srcnat out-interface=sfp-sfpplus12

Right now, that NAT rule is above these NAT rules. Would changing that negatively impact any of these rules?

add action=src-nat chain=srcnat src-address=192.168.5.80 to-addresses=my.public.ip.9
add action=dst-nat chain=dstnat dst-address=my.public.ip.9 dst-port=10051 protocol=tcp to-addresses=172.16.1.1
add action=dst-nat chain=dstnat dst-address=my.public.ip.10 dst-port=80,443,990,5022,7000-7009 protocol=tcp to-addresses=192.168.5.40
add action=src-nat chain=srcnat src-address=192.168.5.37 to-addresses=my.public.ip.7
add action=dst-nat chain=dstnat dst-address=my.public.ip.7 dst-port=80,443,5005,5008 protocol=tcp to-addresses=192.168.5.37

This makes it sound like I would have to specify multiple prefixes/ranges and keep updating that as new LAN subnets are added. Is there any way to make my.public.ip.12 the default for everything not specifically NATed in the rules above?

These rules can be fine-tuned to assign source addresses from a pool to particular traffic, as you can specify to-addresses as a prefix or range, such as to-addresses=112.122.132.5-112.122.132.7.

sindy · Wed Oct 05, 2022 11:48 pm

You actually don't have a single masquerade rule, you have a ton of them, some of them disabled.

So rather than a step-by-step instruction I give you a general advice: the order of rules within a chain matters - a packet is compared to the match conditions of the rules, starting from the first (topmost) one downwards until the first match. So put the rules matching the most specific cases towards the top of the list and the least specific rules towards its bottom. And the very last rule in the srcnat chain will match only on the out-interface, so it will handle whatever did not match to the previous rules.

For action=src-nat, to-addresses must be specified.

RouterOS scripting syntax does not clearly distinguish between match conditions (such as out-interface or src-address) and parameters of the action (such as to-addresses or to-ports), so you may have to consult the manual for some time.

joegoldman · Thu Oct 06, 2022 12:07 am

Using src-nat instead of masquerade rule, lets you specify which IP you use for outgoing connections (so you'd set to public.ip.12 if thats what you wanted), that will work for NAT and shouldn't affect anything else.

The firewall rules are processed in order, so if a packet matches the criteria of an earlier rule it won't hit later rules (unless certain actions + Passthrough are enabled)

So the rule:
add action=src-nat chain=srcnat out-interface=sfp-sfpplus12

Will match any traffic that is routed out via sfp-sfpplus12, and NAT it. If there are rules above this rule that matches the inspected traffic, it will not make it here. Generally, if you have specific rules, you'd want them first and your 'catch-all' NAT rule at the bottom.

Without changing any other order of operation, simply changing that masquerade rule to action=src-nat to-addresses=your.public.ip.12, should then tag any outbound traffic not captured by other rules as your .12 IP instead of .4 (or the lowest)

Limit Interface to Specific IP from Address List

Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Re: Limit Interface to Specific IP from Address List

Who is online