Lab 06-07 · Source NAT and masquerade: one address for the whole house¶
MTCNA
Module 6 · Firewall of the MikroTik MTCNA course, official slides p271–273 (masquerade, the src-nat action, and NAT helpers / service ports).
At home, how many devices are online right now? Phones, a laptop, a TV, a console, maybe a smart speaker. Ten devices is normal. Yet your Internet provider gave your house one public address. How do ten devices share one address, and how does a web page find its way back to the right phone?
The answer is a single rule you have had in every lab so far without looking at it: masquerade. In this lab the rule is missing. Your laptop's packets leave the house with their private address on them, and the answers never come back. You will watch them get lost, put the rule back, and look inside the router's memory to see the disguise at work.
What you will learn
- Explain source NAT and why a LAN with private addresses needs it to use the Internet.
- Explain masquerade as the src-nat that uses the WAN port's address automatically.
- Diagnose "packets go out but nothing comes back" as a missing src-nat.
- Read connection tracking to see the original and the translated address of a connection.
- Recognise the traps: masquerade on the LAN interface, and NAT helpers for awkward protocols.
Source NAT and masquerade¶
Source NAT (src-nat) rewrites the source address (and possibly port) of packets leaving the router. masquerade is a special src-nat that uses the address of the outgoing interface, whatever it is at that moment.
In the club: everybody who leaves through the front door puts on the club's T-shirt. Outside, people only see "someone from the club". When an answer comes back for "the club", the bouncer remembers who was wearing which T-shirt (connection tracking) and hands the answer to the right guest.
| Action | New source address | When to use it |
|---|---|---|
| masquerade | the current address of the out-interface, picked automatically | WAN address from DHCP/PPPoE that may change: every home router |
| src-nat | a fixed address you give in to-addresses | a static public address; special cases such as the merged companies on slide 272 |
sequenceDiagram
participant P as pc1<br>192.168.88.200
participant R as r1<br>WAN 10.0.0.x
participant S as internet<br>198.51.100.10
P->>R: from 192.168.88.200 to 198.51.100.10
Note over R: srcnat masquerade: source becomes 10.0.0.x (remembered)
R->>S: from 10.0.0.x to 198.51.100.10
S->>R: reply to 10.0.0.x
Note over R: looks up its memory: this was 192.168.88.200
R->>P: reply to 192.168.88.200Why does the slide's example use a private address on both sides?
Slide 272 describes two merged companies that both used 172.16.0.0/16 internally. Masquerade cannot help there: each side needs src-nat (and dst-nat) to a "buffer" network so the two identical address ranges never meet. You will not build it here, but it shows src-nat is more than masquerade.
The scenario¶
On a real hAP the Internet port is ether1; in the virtual lab ether1 is reserved for the lab itself, so the Internet port is ether2 and the LAN ports start at ether3.
flowchart LR
PC1["<b>pc1</b> (your laptop)<br>192.168.88.200"] -- "LAN" --- R1["<b>r1</b> (the club)<br>bridge1: 192.168.88.1/24<br>ether2 = WAN: 10.0.0.x<br><b>no masquerade!</b>"]
R1 -- "class network<br>10.0.0.0/24" --- AP["<b>class-ap</b> (the ISP)<br>10.0.0.1 · 198.51.100.1<br>knows nothing about 192.168.88.0/24"]
AP --- NET["<b>internet</b><br>198.51.100.10"]| Node | Role | Address |
|---|---|---|
pc1 |
your laptop | 192.168.88.200 (DHCP) |
r1 |
your router, without its masquerade rule | LAN 192.168.88.1/24 · WAN ether2 10.0.0.x |
class-ap |
the trainer's router, the "ISP"; it masquerades the class towards the Internet | 10.0.0.1 and 198.51.100.1 |
internet |
"the Internet": web server; it logs every visitor's address | 198.51.100.10 |
Start the lab¶
Download the lab files and unzip them: 06-07-masquerade-src-nat.zip. Open a terminal inside the 06-07-masquerade-src-nat folder.
From the lab folder guions/tema-3/lab/mtcna/06-07-masquerade-src-nat/:
After about two minutes:
ssh admin@clab-mtcna-06-07-r1 # your router (password: admin)
ssh admin@clab-mtcna-06-07-class-ap # the trainer's router, to look only (password: admin)
docker exec -it clab-mtcna-06-07-pc1 bash # the laptop
Step 1 · Notice that the Internet is gone¶
IP → Firewall → NAT on r1:
Empty. On pc1:
curl -s --max-time 4 http://www.mikrotik.com; echo "exit $?" # exit 28: timeout
ping -c2 -W2 198.51.100.10 # 100% packet loss
Interesting: DNS still worked (curl got as far as connecting), because the router asked class-ap, using its own WAN address. Your laptop's packets are the ones that get lost.
Check yourself
The router itself can reach class-ap and the Internet, but pc1 cannot. What is different between the router's packets and pc1's packets?
Done when: pc1 cannot reach 198.51.100.10.
Step 2 · Follow the lost packets¶
Where do they get lost? Look at the trainer's router (read only, do not change it):
You will see your laptop's connections arriving at class-ap with source 192.168.88.200. class-ap even forwarded them to the Internet and got answers back. But to deliver an answer to 192.168.88.200, class-ap needs a route to 192.168.88.0/24, and it has none: that network is your private business. The answers die there.
Check yourself
In one sentence: why does the packet reach the server but the answer never returns to pc1?
Done when: you have seen 192.168.88.200 in class-ap's connection list.
Step 3 · Put the T-shirt on: masquerade¶
IP → Firewall → NAT → + · General: Chain srcnat, Out. Interface ether2 ·
Action: masquerade · Comment LAN to Internet
Out. Interface ether2 means "only packets leaving through the WAN port". On pc1:
Masquerade on the wrong side
A classic mistake is out-interface=bridge1 (the LAN). Then the disguise is applied to packets going
into your house, and the ones going out still carry 192.168.88.200: nothing works. Masquerade
always goes on the interface that faces the Internet.
Check yourself
Your ISP gives you a new WAN address tomorrow. Do you have to change the masquerade rule? Why?
Done when: pc1 opens the Internet page again.
Step 4 · Look inside the router's memory¶
IP → Firewall → Connections on r1:
Pick a protocol=tcp entry with dst-port=80. It has the flag s (srcnat) and two halves:
src-address=192.168.88.200:... dst-address=198.51.100.10:80: the packet as your laptop sent it;reply-src-address=198.51.100.10:80 reply-dst-address=10.0.0.x:...: what the answer looks like: it is addressed to the router's WAN address, the T-shirt.
Now the counter:
Only one packet per connection (the first), as in lab 06-05.
Check yourself
The web server on internet logs every visitor (tail /var/log/http.log inside the internet node).
It shows 198.51.100.1, not r1's WAN address. Why? (Hint: who else wears a T-shirt between r1 and the Internet?)
Done when: you found the connection whose reply-dst-address is r1's WAN address.
Step 5 · NAT helpers, then the checker¶
Some old protocols (FTP, SIP for phone calls, PPTP...) write IP addresses inside their messages, where plain NAT does not look. RouterOS fixes them with NAT helpers, listed in IP → Firewall → Service Ports (slide 273):
You will see entries such as ftp, sip, pptp, enabled or not. You do not need to change them; just know
that "FTP works except file listings" behind NAT usually means a helper is off.
Run the checker from the lab folder on your PC:
It must end with RESULT: lab 06-07 solved.
Check yourself
Which NAT helpers are disabled (X) on your router? Pick one enabled helper and say which protocol it belongs to.
Done when: check.sh passes.
If something goes wrong¶
| Symptom | Likely cause | Fix |
|---|---|---|
| Still no Internet after the rule | out-interface=bridge1 (the LAN) instead of ether2 |
change it to the WAN port |
| Still no Internet, rule correct | the rule is disabled, or in chain dstnat |
/ip firewall nat print detail |
| DNS works, web does not | that is exactly the symptom of a missing masquerade | add the rule |
| The connection list is empty | the curl finished long ago and its entry expired | run curl again and print right away |
| r1 has no WAN address | DHCP client on ether2 not bound yet | /ip dhcp-client print, wait a minute |
Clean up¶
Key takeaways¶
- Source NAT rewrites the source address of packets leaving the router, so private LANs can use the Internet.
- masquerade uses the current address of the out-interface: ideal when the WAN address comes from DHCP and may change.
- src-nat uses a fixed to-addresses: for static public addresses and special designs.
- Put masquerade on the WAN (out-interface), never on the LAN.
- Connection tracking remembers each translation; the reply side shows the router's WAN address.
- NAT helpers (service ports) fix protocols that hide addresses inside their messages, such as FTP or SIP.
Quick check¶
1. What does source NAT change?
- The source address of packets leaving the router
- The destination address of packets arriving at the router
- The MAC address of the LAN devices
- The port where the router's WebFig listens
src-nat rewrites who the packet seems to come from. dst-nat rewrites where it goes.
2. Why is masquerade the usual choice on a home router?
- Because it is faster than any other rule
- Because it also filters attacks
- Because it picks the WAN address automatically, even if it changes
- Because src-nat does not exist on MikroTik
The home WAN address comes from the ISP by DHCP or PPPoE and can change. masquerade always uses the current address of the out-interface; src-nat would need you to edit to-addresses each time.
3. Without masquerade, pc1's packets reach the Internet server but no answer arrives. Why?
- The server refuses private addresses
- The answers are addressed to 192.168.88.200, which the upstream network cannot route back
- The router's firewall drops the answers
- DNS is broken
The answers go to the private address 192.168.88.200. Nobody upstream has a route to your LAN, so they are lost on the way back.
4. Which out-interface should the masquerade rule use on r1?
- bridge1
- ether3
- ether2
- ether1
Masquerade applies to packets leaving towards the Internet: the WAN port, ether2 in this lab (ether1 on a real hAP).
5. What does the reply-dst-address of a masqueraded connection show?
- The laptop's private address
- The router's WAN address, where the answer is sent
- The address of the DNS server
- The broadcast address of the LAN
The reply half of the connection shows what the answers look like: addressed to the router's WAN address. The router then translates them back to the laptop.
6. Behind your router, file listings over FTP fail although logins work. Which two statements are reasonable?
- FTP writes addresses inside its messages, which plain NAT does not rewrite
- Masquerade must be moved to the LAN interface
- Check that the ftp NAT helper is enabled in IP, Firewall, Service Ports
- FTP can never work behind NAT
Some protocols carry IP addresses inside their data. NAT helpers (service ports) rewrite them; if the ftp helper is off, the data connection fails.
The router now translates addresses in both directions and remembers every conversation. In the last lab, 06-08 · Connection tracking, you put that memory to work and build a stateful firewall: the hand stamp at the club door.