Using NAT on Mikrotik

Hellothere · Mon Apr 08, 2024 3:22 pm

Hey, I am new to Mikrotik and I am trying to configure my own network. So far I got a router which has on every port (1-5) different subnets (10.10.1.0, 10.10.2.0,..,10.10.5.0). Ive connected a raspberry pi with the ip address 10.10.1.1 with port 1 (subnet 10.10.1.0) and my laptop to port 5. My laptop has the ip addresss 10.10.5.2. After that I set some firewall rules. My "private" subnet is 10.10.1.0 and my "public" is 10.10.5.0. First of all I activated source nat for the public subnet:

/ip firewall nat add chain=srcnat src-address=10.10.5.0/24 action=masquerade out-interface=ether5 to-address=10.10.5.50/24

my nat rules look like this:

[admin@Router-10] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
 0    chain=dstnat action=dst-nat to-addresses=10.10.1.1 to-ports=22
      protocol=tcp dst-port=10022

 1    chain=srcnat action=masquerade to-addresses=10.10.5.50
      src-address=10.10.1.0/24

so after that I add some filters:

[admin@Router-10] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
 0    chain=forward action=drop src-address=10.10.5.0/24
      dst-address=10.10.1.0/24

 1    chain=forward action=drop connection-state=new dst-address=10.10.1.0/24

 2    chain=forward action=drop connection-nat-state=!dstnat
      dst-address=10.10.1.0/24

now I want to connect via ssh to my raspberry pie from laptop. For that I added port mapping:

/ip firewall nat add chain=dstnat action=dst-nat to-addresses=10.10.1.1 to-ports=22
      protocol=tcp dst-port=10022

But I can't establish a connection. Why that?

anav · Mon Apr 08, 2024 3:33 pm

Network diagram often helps understand what you are doing,
need full config
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

Hellothere · Wed Apr 10, 2024 6:05 pm

Network diagram often helps understand what you are doing,
need full config
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

First of all, thank you for the reply. I attached a drawing of my network hope this is fine. So my main Problems are. I can't ping from my raspberry my pc and can't connect via ssh with my raspberry from my pc. So I post here the routing table of the raspberry pi:
0.0.0.0 10.10.1.254 0.0.0.0
10.10.1.0 0.0.0.0 255.255.255

The firewall setting which I configured had I posted above. The routing table of the router is the following:
[admin@Router-10] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADC 10.10.1.0/24 10.10.1.254 ether1 0
1 DC 10.10.2.0/24 10.10.2.254 ether2 255
2 DC 10.10.3.0/24 10.10.3.254 ether3 255
3 DC 10.10.4.0/24 10.10.4.254 ether4 255
4 ADC 10.10.5.0/24 10.10.5.254 ether5 0

Pls inform me of the settings you need to see.

Hellothere · Wed Apr 10, 2024 6:43 pm

Network diagram often helps understand what you are doing,
need full config
/export file=anynameyouwish (minus router serial number, any public WANIP information, keys etc.)

My main problem are my filters and nat rules. Why can I not do an ssh with my raspberry pi? I tried some things. First I removed all filters then the masking worked, but I didn't got a ping reply , when I tried to ping from the raspberry to the pc. The ssh worked without the filters. When I activate the filters again nothing worked.

loloski · Wed Apr 10, 2024 10:14 pm

Please don't double post, I believed the issue here is the same with your other post which i reply as well

It is common issue with new user is that they don't RTFM i believed it was mentioned in the docs that you should enumerate your WAN and LAN interface in the interface list, so that you are not going to be surprise why it's not working, the default firewall rules of mikrotik is sane for your own good you just have to read a little bit on how things done

Hellothere · Thu Apr 11, 2024 11:39 am

Please don't double post, I believed the issue here is the same with your other post which i reply as well

It is common issue with new user is that they don't RTFM i believed it was mentioned in the docs that you should enumerate your WAN and LAN interface in the interface list, so that you are not going to be surprise why it's not working, the default firewall rules of mikrotik is sane for your own good you just have to read a little bit on how things done

Hey, yeah sure but i want to separate a little bit between these two topics. The problem with ssh is now working. It was the filters. After i put the rule in ONE filter then the ssh worked.
The problem now is that my pc doesnt send a ping reply too the masked ip address of the raspberry.

Using NAT on Mikrotik

Using NAT on Mikrotik

Re: Using NAT on Mikrotik

Re: Using NAT on Mikrotik

Re: Using NAT on Mikrotik

Re: Using NAT on Mikrotik

Re: Using NAT on Mikrotik

Who is online