Hello
I am bridging two Ethernet interfaces which have a number of vlans running over them. I want to be able to set up a destination nat for addresses in an address-list.
At first I did not know about the setting "use-ip-firewall-for-vlan"
I was about to write a script to run on startup to delete everything then add them again when I stumbled upon the use-ip-firewall-for-vlan command I mentioned earlier. When I have this enabled and only have one bridge (for just the ethernet interfaces) the dst-nat chain sees packets going by but my destination nat does not work correctly. I just lose my connection to everything.
If this does not make sense I can upload my config or Supourt.rif for the different situations.
How should I be doing this?...
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I already am running 3.25, I have thought about upgrading to the non-stable version or perhaps downgrading though.
Its for a transparent "destination nat". When they try to access any ip address, and I have them in my non-payment address list, everything they try to go to gets sent to whatever IP I choose. I am not ready to replace our current router with a mikrotik so it has to be transparent... to my knowledge.
Hi,
actually never come across a term like 'transparent nat' before, so I'm not quite sure what you mean...
OK, so you are saying that you already have a router in place, and you want to use the mikrotik as a kind of access controller in a bridge arrangement?
It's a very odd setup, I must say, and if I had to work on something like that I would have to approach it as a purely experimental configuration - i.e. trial and error.
are you using a dst-nat directed to the mikrotik web proxy?
how do you determine the difference between 'non paying' and others?
Cheers.
I guess what I mean by "transparent nat" is that 99% of the time it is a transparent bridge, but at times it runs NAT.
"so you are saying that you already have a router in place, and you want to use the mikrotik as a kind of access controller in a bridge arrangement?" -> Yes
are you using a dst-nat directed to the mikrotik web proxy? -> No, but good idea...
It is pointed to an Apache web server. Anything received on one IP(thats not one of the virtual domains or whatever you call them) gets set a redirected to one of the virtual domains on that server. The first configuration mentioned works perfectly (until rebooted) unless the web server is also behind the mikrotik. If I can get the mikrotik web proxy to work I wont have to worry about where the web server is on the network.
PC server, licensed, at home now so cant look up the hardware, but I know it has an Intel chipset, Intel Ethernet adapters, a core 2 duo 3GigHz processor.
and no errors in the log when it boots up.
If I am not doing anything wrong I will just write the script to delete all the interfaces, bridges and ports and re-add them for a work around and close the ticket and send the mikrotik people my support.rif
Thanks for the help.
Business Accounts
Answer for Membership
by: meverestPosted on 2009-06-18 at 15:27:27ID: 24662328
Hi,
first of all, bridge configuration will normally survive a reboot, so perhaps you should start by upgrading to the latest routerOS (v3.25)
if you have vlans on each network segment, then bridging vlans is the correct way to span across.
for NAT, though, I don't understand why you would want (or need) to use a bridge in this context. since NAT is technically a routing task, you should be able to acheiev what you need to do without bridging at all.
Cheers.