Tag Info

New answers tagged

0

I would imagine you need to configure a 'split-tunnel', which is not configured by default. A split tunnel will allow you to access the internet directly from your Surface rather than traversing your tunnel and accessing the internet through your server/router. If that violates your security policy then you have a routing issue in RRAS. If you need a ...


0

The PF firewall has NAT and redirection build right in. Add this to /etc/rc.conf: gateway_enable="YES" pf_enable="YES" And configure the firewall. Add these lines to /etc/pf.conf: ext_if=em0 ext_addr = N.N.N.N (your external IP) int_if=em1 int_net=10.0.0.0/8 int_addr=10.0.0.1 libcap_host=10.0.0.2 nat on $ext_if from $int_net to any -> $ext_addr rdr ...


1

To achieve this you need to create 2 firewall rules (mangle & nat) and add a static route. First you create the mangle rule which will mark the packets of the specific IP you want to route through WAN2 with a new routing mark. Replace 192.168.1.X with the IP you want to route via WAN2. /ip firewall mangle add chain=prerouting src-address=192.168.1.X \ ...


2

You'll be able to do this with policy based routing, which can be done with the mangle table. Essentially it allows you to define a number of conditions and select a next hop based on them. It's well covered here: http://wiki.mikrotik.com/wiki/Policy_Base_Routing


0

Hyper-V doesn't work like this. Forward ports as you would to physical servers - start looking at your firewalls or load balancing appliances.


0

Try using REDIRECT of iptables. iptables -t nat -I PREROUTING -d <public ip> -p tcp --dport 54321 -j REDIRECT --to-port 12345 If you need udp, just change the protocol.


0

Figured this out, posting what I believe is the answer: The problem was with the ACL within the Access Rules settings. It seems in the 8.3 software the Destination Criteria, Destination: should no longer be the 'outside interface' but the Network Object destination itself. It seems Cisco switched the configuration from being what seems backwards, to the ...


0

I'd say there is one other possibility besides the ones that Alex mentions, and that is that your port forwarding box is the gateway for system A, but not for system B.


0

There is not enough information to close in on a specific issue; I suppose the port forwarding you are asking about is the one on the NAT box, and not the SSH port forwarding feature. If this is the case there may be at least two reasons for this behaviour; one is that box A and B have several IP addresses (say, box A is 10.1.1.50 and 192.168.0.50 and box B ...


0

Well I feel sheepish. The firewall rules work OK, but port 80 was being blocked at the ISP.


0

¿ can do this with amazon ec2 ? Si. You'll just need to make sure that source/destination checks are disabled for that EC2 instace.


-3

Yup, Mem is totally right. Dual Stack and only on the public side of the network is a mandatory first step...that is the real holdup. That is to say nothing of ALSO being ready to just abandon IPv4. NAT devices will do what they have always done. IPv6 provides private address space but there is no way to guarantee that it is globally unique...so we still ...


-5

Yes, of course you can. In fact that is the wisest thing to do. Don't believe people who say "Oh....you will HAVE to change your entire network to Ipv6 eventually, so dont delay" Utter nonsense. I have been through this at the carrier-grade level. IPv4 is here to stay. It works just fine for the vast majority of organizations, because of RFC1918. If ...


1

What you are looking to do is perform REVERSE PORT ADDRESS TRANSLATION. People call it all sorts of crazy things like: NAT Hairpinning, NAT-on-a-stick, NAT reflecting, and NAT loopback. Just to clear this up,.. Hairpinning is a technique used in a NAT-on-a-stick configuration that involves having the NAT "loopback" the traffic. This sounds like what ...


0

You're on the right track. You need two NICs, mainly because your Linux firewall is sending outbound packets in a round-robin fashion when it comes to select a route as they both have the same metric. Having two NICs will just do round-robin per NIC and not per route, keeping each TCP connection on the same NIC. Keep in mind this could still cause you ...


1

You will need to mark the connections coming from ether3_3G so that you can then mark the replies to be routed back via ether3_3G. Here's an example configuration (not tested) /ip firewall mangle add action=mark-connection chain=prerouting comment="Mark connection so packets from 3G get returned to 3G properly" disabled=no in-interface=ether3_3G ...


1

Unless I've been missing something all these years, no it isn't possible. What you are wanting is for your office computers to initiate a request to Youtube across WAN A's tunnel and then receive that request back through WAN B (their normal internet connection). TCP/IP simply doesn't work that way. You're not going to be able to spoof/NAT the source IP ...


4

Check on MASQUERADE target instead of SNAT : it supports the option : --to-ports port[-port] This specifies a range of source ports to use, overriding the default SNAT source port-selection heuristics (see above). This is only valid if the rule also specifies one of the following protocols: tcp, ...


0

I do not think you can control which ports are used for which NAT'd ip's. However if you have any extra IP's in public space you could have take advantage of that by mapping the ones you want to keep track of: iptables -t nat -A POSTROUTING -s 10.8.0.10/32 -o venet0 -j SNAT --to-source 1.2.3.1 iptables -t nat -A POSTROUTING -s 10.8.0.20/32 -o venet0 -j ...


0

Thanks for the export. It turns out that either this configuration is not supported by MikroTik or there is a bug. According to the Packet Flow Diagram, if I understand it correctly, dst-nat should be able to detect the packet/connection marks since mangle prerouting is before dst-nat. But after some tests of my own I got stuck the same as you did. ...


2

I will assume that each of the modems have a private IP address and they're NAT through the internet by your provider using a public IP address. Usually providers block private IP communications with each other (this is called Intra APN communication) the reason is quite obvious: Security. If the subscribers are in the same private network, they likely ...



Top 50 recent answers are included