CloudLabBox
Try the free demo

MikroTik MTCNA lab 11 of 19

NAT: src-nat, masquerade, port forwarding, 1:1 NAT, redirect and hairpin

Publish an internal web server to the Internet with a port forward and a 1:1 NAT address, use src-nat instead of masquerade on a static WAN, force every DNS query through the router with redirect, and make the public address work from inside with hairpin NAT.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,048 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCNA RouterOS v7 guided labs, then 11 - NAT - src-nat masquerade port forwarding 1 -1 NAT redirect and hairpin

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
5 vCPU, 2,048 MB
Smallest plan
Lite

The scenario

An architects' practice has moved its project website onto its own server, Web1, in the office. Fernvale has given the practice a small block of public addresses, 203.0.113.0/29: the router uses .2, and .3 is reserved for Web1. The partners want the site reachable on the public address, the office PCs to keep browsing, and every DNS query to go through the router so that printer.office.example always works, even on laptops with a hard-coded public DNS server.

DeviceInterfaceAddress
GWether1 (WAN)203.0.113.2/29 and 203.0.113.3/29
GWether2 (LAN)192.168.88.1/24
ISPether1 · ether2203.0.113.1/29 · 198.51.100.1/24
Remoteeth0198.51.100.10/24 (a visitor on the Internet; also runs a test web page)
Web1eth0192.168.88.80/24
Office-PCeth0192.168.88.20/24

What you’ll practise

  • Choose between masquerade and src-nat
  • Forward a public port to an internal server with dst-nat
  • Give a server its own public address with 1:1 NAT (dst-nat plus src-nat)
  • Redirect traffic to the router itself
  • Explain why a port forward fails from inside, and fix it with hairpin NAT
  • Read NAT rule counters and connection-table NAT flags

The tasks

  1. Prepare the hosts and their web pages
  2. Use src-nat on a static WAN
  3. Forward a port to Web1
  4. Give Web1 its own public address (1:1 NAT)
  5. Send every DNS query to the router (redirect)
  6. Make the port forward work from inside (hairpin NAT)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of NAT - src-nat masquerade port forwarding 1 -1 NAT redirect and hairpin5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.ISPGWRemoteWeb1Office-PCOffice-LANeth0eth0ether2ether2eth0ether1ether1
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP ether1 to GW ether1
  • ISP ether2 to Remote eth0
  • GW ether2 to Office-LAN (network)
  • Web1 eth0 to Office-LAN (network)
  • Office-PC eth0 to Office-LAN (network)
Nodes in NAT: src-nat, masquerade, port forwarding, 1:1 NAT, redirect and hairpin, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
RemoteAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
Web1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
Office-PCAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCNA RouterOS v7 guided labs.

  3. Open 11 - NAT - src-nat masquerade port forwarding 1 -1 NAT redirect and hairpin and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCNA labs

All MikroTik MTCNA labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.