Community discussions

MikroTik App
  4. RouterOS
  5. General

Hairpin NAT with 2 WAN static IP's and 2 LAN's

Post Reply
 
chindo
just joined
Topic Author
Posts: 4
Joined: Thu Apr 11, 2024 8:57 pm

Hairpin NAT with 2 WAN static IP's and 2 LAN's

Thu Apr 11, 2024 9:24 pm

I know there are lots of posts about hairpin NAT but none of them seem to apply to my setup, so here goes.

WAN1 - Ether1 Static Public IP 1.1.1.1
WAN2 - Ether2 Static Public IP 2.2.2.2
LAN1 - Ether6 10.0.15.0/24
LAN2 - Ether7 10.0.25.0/24
LAN3 - Not in use 192.168.1.0/24
VPN - 192.168.89.0/24
VLAN110 Not in use
VLAN2 Not in use

I have a server on LAN1 being accessed from WAN1. No other devices on LAN1

Devices on LAN2 cannot access server on LAN1 via WAN1. If i am connected to the internet via any means other than the Mikrotik router I can access the server.

All the guides I have found have been about being on the same LAN as the server but I am not. Therefore, I'm stuck. All suggestions are welcome.

Thank you
Code: Select all
# apr/11/2024 11:10:14 by RouterOS 6.48.6
# software id = 4CHZ-D7MN
#
# model = RB2011UiAS
# serial number = HCJ08AG88V6
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN1
set [ find default-name=ether2 ] name=ether2-WAN2
set [ find default-name=ether6 ] name=ether6-LAN1
set [ find default-name=ether7 ] name=ether7-LAN2
/interface vlan
add interface=ether7-LAN2 name=vlan2 vlan-id=2
add interface=ether7-LAN2 name=vlan110 vlan-id=110
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=10.0.15.100-10.0.15.150
add name=dhcp_pool1 ranges=10.0.25.100-10.0.25.150
add name=vpn ranges=192.168.89.2-192.168.89.255
add name=dhcp_pool5 ranges=10.0.25.100-10.0.25.254
add name=dhcp_pool6 ranges=192.168.1.1-192.168.1.254
add name=dhcp_pool7 ranges=192.168.110.100-192.168.110.254
add name=dhcp_pool8 ranges=192.168.1.100-192.168.1.254
add name=dhcp_pool9 ranges=192.168.2.100-192.168.2.254
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=ether6-LAN1 name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=ether7-LAN2 name=dhcp2
add address-pool=dhcp_pool7 disabled=no interface=vlan110 name=dhcp3
add address-pool=dhcp_pool9 disabled=no interface=vlan2 name=dhcp4
/ppp profile
set *FFFFFFFE dns-server=10.0.15.1 local-address=192.168.89.1 remote-address=\
    vpn
/interface l2tp-server server
set enabled=yes use-ipsec=yes
/interface list member
add interface=ether1-WAN1 list=WAN
add list=LAN
add interface=ether2-WAN2 list=WAN
add interface=ether6-LAN1 list=LAN
add interface=ether7-LAN2 list=LAN
/interface pptp-server server
set enabled=yes
/interface sstp-server server
set default-profile=default-encryption enabled=yes
/ip address
add address=10.0.15.1/24 interface=ether6-LAN1 network=10.0.15.0
add address=10.0.25.1/24 interface=ether7-LAN2 network=10.0.25.0
add address=192.168.1.1/24 disabled=yes interface=ether7-LAN2 network=\
    192.168.1.0
add address=192.168.110.1/24 interface=vlan110 network=192.168.110.0
add address=192.168.1.1/24 disabled=yes interface=ether7-LAN2 network=\
    192.168.1.0
add address=192.168.2.1/24 interface=vlan2 network=192.168.2.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add disabled=no interface=ether1-WAN1
add disabled=no interface=ether3
add disabled=no interface=ether2-WAN2
/ip dhcp-server network
add address=10.0.15.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=10.0.15.1
add address=10.0.25.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=10.0.25.1
add address=10.0.25.1/32 dns-server=8.8.8.8,8.8.4.4 gateway=10.0.25.1 \
    netmask=24
add address=192.168.1.0/24 dns-server=8.8.8.8 gateway=192.168.1.1 netmask=24
add address=192.168.2.0/24 gateway=192.168.2.1
add address=192.168.110.0/24 gateway=192.168.110.1
/ip firewall address-list
add address=10.0.15.0/24 list=LAN
add address=1.1.1.1 list=WAN
/ip firewall mangle
add action=accept chain=prerouting comment="Allow ping gateway LAN2" \
    dst-address=10.0.25.1 src-address=10.0.25.0/24
add action=mark-routing chain=prerouting comment="LAN1 go to WAN1" \
    new-routing-mark=LAN1_TO_WAN1 passthrough=yes src-address=10.0.15.0/24
add action=mark-routing chain=prerouting comment="LAN2 go to WAN2" \
    new-routing-mark=LAN2_TO_WAN2 passthrough=yes src-address=10.0.25.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\
    10.0.15.0/24 src-address=10.0.15.0/24
add action=masquerade chain=srcnat out-interface=ether1-WAN1
add action=dst-nat chain=dstnat dst-address-list=WAN dst-port=443 protocol=\
    tcp to-addresses=10.0.15.10 to-ports=443
add action=dst-nat chain=dstnat dst-address-list=WAN dst-port=5060-5080 \
    protocol=tcp to-addresses=10.0.15.10 to-ports=5060-5080
add action=dst-nat chain=dstnat comment="Used for Telnyx IP Auth Connections" \
    dst-address-list=WAN dst-port=5080 protocol=udp to-addresses=10.0.15.10 \
    to-ports=5080
add action=dst-nat chain=dstnat dst-address-list=WAN dst-port=80 protocol=tcp \
    to-addresses=10.0.15.10 to-ports=80
add action=masquerade chain=srcnat comment="masq. vpn traffic" dst-address=\
    10.0.15.0/24 src-address=192.168.89.0/24
add action=masquerade chain=srcnat out-interface=ether2-WAN2
add action=dst-nat chain=dstnat disabled=yes dst-address-list="" dst-port=\
    16384-32768 protocol=udp to-addresses=10.0.15.10 to-ports=16384-32768
/ip route
add disabled=yes distance=1 gateway=isp.gat.ewa.y11 routing-mark=LAN1_TO_WAN1
add distance=1 gateway=isp.gat.ewa.y11 routing-mark=LAN2_TO_WAN2
add check-gateway=ping distance=1 dst-address=10.0.15.1/32 gateway=10.0.15.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
/ppp secret
add name=vpn
/system clock
set time-zone-name=America/Vancouver
/system identity
set name=RouterOS
/tool sniffer
set file-name=sniff filter-stream=yes streaming-enabled=yes streaming-server=\
    192.168.89.254
Top
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19467
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:
Contact anav

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Fri Apr 12, 2024 12:00 am

Well when you have to have a consistent config, and plan.
You are stuck between assigning subnets to ports, and having vlans.
Suggest if you are considering doing vlans, drop subnets to ports.
If not, then drop vlans.

Let me know which way you go as I dont want to waste time.
Top
 
Sob
Forum Guru
Forum Guru
Posts: 9121
Joined: Mon Apr 20, 2009 9:11 pm

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Sat Apr 13, 2024 1:57 am

Good news! If you have server in LAN1 (one subnet) and clients in LAN2 (another subnet), then the problem that's solved by hairpin NAT doesn't occur. So you don't need hairpin NAT.

Your problem (aside from non-existent firewall filter section, but that's another story) is the mangle rule that marks routing for everything coming from LAN2. Including those packets that should go to server in LAN1. When you mark them, they will go to internet. So just exclude them, e.g. using the same approach as your existing "Allow ping gateway LAN2" (but with dst-address-list=WAN).
Top
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 19467
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:
Contact anav

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Sat Apr 13, 2024 3:22 am

Nice to see you Sob!!
Top
 
chindo
just joined
Topic Author
Posts: 4
Joined: Thu Apr 11, 2024 8:57 pm

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Tue Apr 16, 2024 7:41 pm

Well when you have to have a consistent config, and plan.
You are stuck between assigning subnets to ports, and having vlans.
Suggest if you are considering doing vlans, drop subnets to ports.
If not, then drop vlans.

Let me know which way you go as I dont want to waste time.
Hi there,

Sorry I should have clarified, the VLAN's were simply for testing purposes for a customer system I was setting up. These can (and will) be removed. I am simply concerned with the 2 subnets on eth 5 and 6, with 2 WAN's on eth 1 and 2.

Thank you for your time, I wouldn't want to waste it. You guys are clearly knowledgeable and I appreciate the help.
Top
 
chindo
just joined
Topic Author
Posts: 4
Joined: Thu Apr 11, 2024 8:57 pm

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Tue Apr 16, 2024 7:44 pm

Good news! If you have server in LAN1 (one subnet) and clients in LAN2 (another subnet), then the problem that's solved by hairpin NAT doesn't occur. So you don't need hairpin NAT.

Your problem (aside from non-existent firewall filter section, but that's another story) is the mangle rule that marks routing for everything coming from LAN2. Including those packets that should go to server in LAN1. When you mark them, they will go to internet. So just exclude them, e.g. using the same approach as your existing "Allow ping gateway LAN2" (but with dst-address-list=WAN).
I didn't think hairpin NAT should be a problem with my setup but I couldn't think of any other reason why I couldn't reach the domain name associated to WAN 1 from LAN 2. So I'm interested in this mangle rule you speak of. Assuming I'm an idiot (because quite frankly I feel like I am with this router) which rule is this mangle rule? And what would you recommend for this non-existent firewall filter section? And what would that do? See.....I'm an idiot!!

Thank you for your time, I really do appreciate your knowledge and insight.
Top
 
chindo
just joined
Topic Author
Posts: 4
Joined: Thu Apr 11, 2024 8:57 pm

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Tue Apr 16, 2024 7:54 pm

Good news! If you have server in LAN1 (one subnet) and clients in LAN2 (another subnet), then the problem that's solved by hairpin NAT doesn't occur. So you don't need hairpin NAT.

Your problem (aside from non-existent firewall filter section, but that's another story) is the mangle rule that marks routing for everything coming from LAN2. Including those packets that should go to server in LAN1. When you mark them, they will go to internet. So just exclude them, e.g. using the same approach as your existing "Allow ping gateway LAN2" (but with dst-address-list=WAN).
I didn't think hairpin NAT should be a problem with my setup but I couldn't think of any other reason why I couldn't reach the domain name associated to WAN 1 from LAN 2. So I'm interested in this mangle rule you speak of. Assuming I'm an idiot (because quite frankly I feel like I am with this router) which rule is this mangle rule? And what would you recommend for this non-existent firewall filter section? And what would that do? See.....I'm an idiot!!

Thank you for your time, I really do appreciate your knowledge and insight.
OK.......you're a genius. After I looked in the "Open your eyes section" I found the Mangle rule. Copied it and ammended as suggested and it works! Thank you! honestly, that's amazing. So how would you feel about looking at another problem I have?

When I'm connected to my VPN, I loose internet connection. I can access everything on my network, but loose internet, which isn't a massive big deal, just more frustrating than anything!
Top
 
Sob
Forum Guru
Forum Guru
Posts: 9121
Joined: Mon Apr 20, 2009 9:11 pm

Re: Hairpin NAT with 2 WAN static IP's and 2 LAN's

Wed Apr 17, 2024 3:12 am

It's not blocked by your firewall, since you don't have any. Srcnat on WAN doesn't have any conditions, so that's not breaking it. Mangle rules won't touch it, so no problem there either. It seems to me that if VPN client 192.168.89.x tries to route internet traffic via this router, it should work. Depending on how you want to route it, you can either tell the client to not do it (and use own direct access to internet), or try to find out what exactly is happening on router. For a quick check, you can try to e.g. ping some unique IP address and then watch for those packets on client and WAN interfaces using Tools->Torch.
Top
Post Reply

Who is online

Users browsing this forum: fassma, jhoney12, Laxity and 46 guests
  4. RouterOS
  5. General