Mikrotik Multiple Public IP's

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Mikrotik Multiple Public IP's

jm3

87 posts

Master Geek
+1 received by user: 20

ID Verified

#277298 6-Oct-2020 20:19

Hi,

I had a Edgerouter Lite die and I'm trying to configure a Mikrotik in it's place but I'm having trouble with the static IP block that was provided from the ISP.

I need to allow two of the public IP addresses to accept port 8000 based on an allowed list of IP's, each public IP routes to a different internal server. I've tried 1 to 1 NAT configurations but think I must be missing something subtle.

The connection is UFB PPPOE, no VLAN tagging and the static block is routed to our main IP.

Should I be explicitly adding the static IP info somewhere in the Mikrotik?

Any help appreciated.

Cheers

nztim

4012 posts

Uber Geek
+1 received by user: 2710

ID Verified

Trusted

TEAMnetwork

Subscriber

#2580314 6-Oct-2020 20:35

No need to add the (I am assuming) /30 to an interfaces if its routed to your PPPoE you can just pick this up with nat rules to/from your server

For the mikrotik make sure MAC server and discovery is disabled on your WAN interface and also ensure Winbox and DNS and other ports are firewalled on your WAN interface.

Any views expressed on these forums are my own and don't necessarily reflect those of my employer.

jm3

87 posts

Master Geek
+1 received by user: 20

ID Verified

#2580343 6-Oct-2020 21:29

Thanks. I'll have another look at my rules again.
It's a 0.0.0.0/29 range but we currently only use two of them.

nztim

4012 posts

Uber Geek
+1 received by user: 2710

ID Verified

Trusted

TEAMnetwork

Subscriber

#2580371 6-Oct-2020 22:19

jm3: Thanks. I'll have another look at my rules again.
It's a 0.0.0.0/29 range but we currently only use two of them.

Here is an example for you

Assuming that:

* You want to port forward TCP 8000

* Your internal subnet is "192.168.5.0/24"

* Your PPPoE interface to your ISP is "pppoe-isp"

* Your internal server is 192.168.5.10

* Your first IP of your /29 is 202.0.0.1

The following syntax will port forward tcp 8000 from 202.0.0.1 to 192.168.5.10

/ip firewall nat add chain=dstnat action=dst-nat to-addresses=192.168.5.10 to-ports=8000 protocol=tcp src-address=0.0.0.0/0 dst-address=202.0.0.1 in-interface=pppoe-isp dst-port=8000

The following syntax will NAT all traffic to from 192.168.5.0/24 out to the internet using 202.0.0.1 instead of your PPPoE ip address

/ip firewall nat add chain=srcnat action=src-nat to-addresses=202.0.0.1 src-address=192.168.5.0/24 out-interface=pppoe-isp

I will also repeat my above message secure your Mikrotik WAN interface so it doesn't get hacked (as per previous post)

Any views expressed on these forums are my own and don't necessarily reflect those of my employer.

jm3

87 posts

Master Geek
+1 received by user: 20

ID Verified

#2590019 21-Oct-2020 20:23

Thanks I really appreciate the quick help.

I had trouble getting the dnat working as above I was able to use netmap to get things working temporarily while I configured our new edge router. I really need to up my mikrotik skills.