Nat Applications - MikroTik RouterOS v2.9 Reference Manual

time ( time | time | sat | fri | thu | wed | tue | mon | sun ) - allows to create filter based on the packets'
arrival time and date or, for locally generated packets, departure time and date
to-addresses ( IP address | IP address ; default: 0.0.0.0 ) - address or address range to replace
original address of an IP packet with
to-ports ( integer : 0 ..65535 | integer : 0 ..65535 ) - port or port range to replace original port of an
IP packet with
tos ( max-reliability | max-throughput | min-cost | min-delay | normal ) - specifies a match to the
value of Type of Service (ToS) field of IP header
• max-reliability - maximize reliability (ToS=4)
• max-throughput - maximize throughput (ToS=8)
• min-cost - minimize monetary cost (ToS=2)
• min-delay - minimize delay (ToS=16)
• normal - normal service (ToS=0)

NAT Applications

Description
In this section some NAT applications and examples of them are discussed.
Basic NAT configuration
Assume we want to create router that:
• "hides" the private LAN "behind" one address
• provides Public IP to the Local server
• creates 1:1 mapping of network addresses
Example of Source NAT (Masquerading)
If you want to "hide" the private LAN 192.168.0.0/24 "behind" one address 10.5.8.109 given to you
by the ISP, you should use the source network address translation (masquerading) feature of the
MikroTik router. The masquerading will change the source IP address and port of the packets
originated from the network 192.168.0.0/24 to the address 10.5.8.109 of the router when the packet
is routed through it.
To use masquerading, a source NAT rule with action 'masquerade' should be added to the firewall
configuration:
/ip firewall nat add chain=srcnat action=masquerade out-interface=Public
All outgoing connections from the network 192.168.0.0/24 will have source address 10.5.8.109 of
the router and source port above 1024. No access from the Internet will be possible to the Local
addresses. If you want to allow connections to the server on the local network, you should use
destination Network Address Translation (NAT).
Copyright 1999-2007, MikroTik. All rights reserved. Mikrotik, RouterOS and RouterBOARD are trademarks of Mikrotikls SIA.
Other trademarks and registred trademarks mentioned herein are properties of their respective owners.
Page 463 of 695