networking:mikrotik:hairpin_nat
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| networking:mikrotik:hairpin_nat [2016/03/08 12:32] – rplecko | networking:mikrotik:hairpin_nat [2021/05/19 17:30] (current) – rplecko | ||
|---|---|---|---|
| Line 3: | Line 3: | ||
| [[http:// | [[http:// | ||
| - | In the below network topology a web server behind a router is on private | + | Interfaces from //ether1// to //ether5// are in the bridge with IP address |
| - | [[http:// | + | In the below network topology a web server behind a router is on private IP address space, and the router performs NAT (dst-nat) to forward traffic which was destined to its public IP address, to the web server behind it (on local network). |
| + | |||
| + | [[http:// | ||
| **The NAT configuration would look like below:** | **The NAT configuration would look like below:** | ||
| + | First the masquerade which will allow private network to access Internet: | ||
| < | < | ||
| /ip firewall nat | /ip firewall nat | ||
| - | add chain=dstnat dst-address=1.1.1.1 protocol=tcp dst-port=80 action=dst-nat to-address=192.168.1.100 | ||
| add chain=srcnat out-interface=WAN action=masquerade | add chain=srcnat out-interface=WAN action=masquerade | ||
| </ | </ | ||
| + | Then the dst-nat which will allow clients from Interent to access our web server behind NAT on private ip 192.168.1.100 | ||
| + | < | ||
| + | /ip firewall nat | ||
| + | add chain=dstnat dst-address=1.1.1.1 protocol=tcp dst-port=80 action=dst-nat to-address=192.168.1.100 | ||
| + | </ | ||
| When a client out on the Internet with IP address <fc # | When a client out on the Internet with IP address <fc # | ||
| - | ^ | + | |Step^Source IP address^Destination IP address^ Description |
| - | ^Step - 01 | 2.2.2.2 | 1.1.1.1 | | + | ^01|2.2.2.2|1.1.1.1|the client sends a packet with a source IP address of <fc # |
| - | ^Step - 02 | 2.2.2.2 | 192.168.0.100 | | + | ^02|2.2.2.2|192.168.0.100|the router destination NATs the packet to <fc # |
| - | ^Step - 03 | 192.168.0.100 | 2.2.2.2 | | + | ^03|192.168.0.100|2.2.2.2|the server replies to the client' |
| - | ^Step - 04 | 1.1.1.1 | 2.2.2.2 | | + | ^04|1.1.1.1|2.2.2.2|the router determines that the packet is part of a previous connection and undoes the destination NAT, and puts the original destination IP address into the source IP address field. The destination IP address is <fc # |
| - | + | ||
| - | - the client sends a packet with a source IP address of <fc # | + | |
| - | | + | |
| - | | + | |
| - | | + | |
| The client receives the reply packet it expects, and the connection is established. | The client receives the reply packet it expects, and the connection is established. | ||
| - | **When a client on the same internal network as the web server requests a connection to the web server' | + | **When a client on the same internal network as the web server requests a connection to the web server' |
| - | ^ | + | |Step^Source IP address^Destination IP address^Description| |
| - | ^Step - 01 | 192.168.0.1 | 1.1.1.1 | | + | ^01|192.168.0.1|1.1.1.1|the client sends a packet with a source IP address of <fc # |
| - | ^Step - 02 | 192.168.0.1 | 192.168.0.100 | | + | ^02|192.168.0.1|192.168.0.100|the router destination NATs the packet to <fc # |
| - | ^Step - 03 | 192.168.0.100 | 192.168.0.1 | | + | ^03|192.168.0.100|192.168.0.1|the server replies to the client' |
| - | + | ||
| - | - | + | |
| - | | + | |
| - | | + | |
| The client receives the reply packet, but it discards it because it expects a packet back from <fc # | The client receives the reply packet, but it discards it because it expects a packet back from <fc # | ||
| - | To fix the issue, an additional NAT rule needs to be introduced on the router to enforce that all reply traffic flows through the router, despite the client and server being on the same subnet. The rule below is very specific to only apply to the traffic that the issue could occur with - if there are many servers the issue occurs with, the rule could be made broader to save having one such exception per forwarded service. | + | To fix the issue, an additional NAT rule needs to be introduced on the router to enforce that all reply traffic flows through the router, despite the client and server being on the same subnet. The rule below is very specific to only apply to the traffic that the issue could occur with - if there are many servers the issue occurs with, the rule could be made broader to save having one such exception per forwarded service. |
| < | < | ||
| + | |||
| /ip firewall nat | /ip firewall nat | ||
| - | add chain=srcnat src-address=192.168.1.0/24 dst-address=192.168.1.2 protocol=tcp dst-port=80 \ | + | add chain=srcnat src-address=192.168.0.0/24 dst-address=192.168.0.100 protocol=tcp dst-port=80 \ |
| out-interface=LAN action=masquerade | out-interface=LAN action=masquerade | ||
| + | |||
| </ | </ | ||
| - | |||
| - | ^ ^ Source IP address ^ Destination IP address | | ||
| - | ^Step - 01 | 192.168.0.1 | 1.1.1.1 | | ||
| - | ^Step - 02 | 192.168.0.254 | 192.168.0.100 | | ||
| - | ^Step - 03 | 192.168.0.100 | 192.168.0.254 | | ||
| - | ^Step - 04 | 1.1.1.1 | 192.168.0.1 | | ||
| With that additional rule, the flow now changes: | With that additional rule, the flow now changes: | ||
| - | - the client sends a packet with a source IP address of <fc # | + | |Step^Source IP address^Destination IP address^Description| |
| - | | + | ^01|192.168.0.1|1.1.1.1|the client sends a packet with a source IP address of <fc # |
| - | | + | ^02|192.168.0.254|192.168.0.100|the router destination NATs the packet to <fc # |
| - | | + | ^03|192.168.0.100|192.168.0.254|the web server replies to the request and sends the reply with a source IP address of <fc #ff0000>192.168.0.100</ |
| + | ^04|1.1.1.1|192.168.0.1|the router determines that the packet is part of a previous connection and undoes both the source and destination NAT, and puts the original destination IP address of <fc # | ||
| The client receives the reply packet it expects, and the connection is established. | The client receives the reply packet it expects, and the connection is established. | ||
| Line 67: | Line 62: | ||
| However, the web server only ever sees a source IP address of <fc # | However, the web server only ever sees a source IP address of <fc # | ||
| - | This is called - among other terms - **hair pin NAT** because the traffic flow has clients enter the router through the same interface it leaves through, which when drawn looks like a hair pin. | + | This is called - among other terms - **hair pin NAT** because the traffic flow has clients enter the router through the same interface it leaves through, which when drawn looks like a hair pin. |
| + | |||
networking/mikrotik/hairpin_nat.1457440347.txt.gz · Last modified: 2016/03/08 12:32 (external edit)