To configure source NAT on Mikrotik using this method, an administrator can enter commands similar to the ones below.Īdd chain=srcnat src-address=192.168.88.0/24 action=masquerade These subnets will only be able to carry out LAN-to-LAN communications using private IPs.

It provides a level of security because network administrators can exclude the subnets they do not want to access the internet. This option allows a user to specify the local subnet as a determining attribute for what IP addresses should be masqueraded. This method for implementing source nat on Mikrotik can be configured on a Mikrotik router using the command below.Īdd chain=srcnat in-interface=ether2 action=masquerade comment=nat_based_on_in_interfaceĪdd chain=srcnat out-interface=ether1 action=masquerade comment=nat_based_on_out_interfaceĬonfiguring source NAT on Mikrotik using source address To allow vpn communications for local area networks configured on the router, user will have to exclude lan-to-lan communication from the source NAT rule. However, it will pose some challenges to ptp tunnels, gre tunnels and ipsec vpn. Source NAT implementation using this option can be considered the easiest. With this method, the source IP addresses may not be listed the router simply masquerades source IPs using in or out interfaces as attributes.

Using this option allows you to instruct the router to masquerade the internal IP addresses for packets entering or exiting the interface specified as in or out.

Configuring source NAT on Mikrotik using the in/out interface This difference in implementation method could work both for/against the user, depending on network design and desired result. Each of these methods will successfully masquerade your internal addresses and use your WAN IP as the source IP for all internet-bound traffics, howbeit, in slightly different ways. Source NAT on Mikrotik can be implemented by using three of these attributes which I am going to go over one after the other: source address, in-interface or out-interface, source address-list.

Mikrotik groove