Firewall · Topic 4 of 6

Source NAT with Masquerade and src-nat

Learn how source NAT rewrites private source addresses on RouterOS, and when to choose the masquerade action or the src-nat action with to-addresses.

5 min

In a nutshell

Source NAT replaces the source address of outgoing packets, in the srcnat chain.
Connection tracking applies the translation to the rest of the connection and reverses it for replies.
Masquerade uses the current address of the outgoing interface.

What it is

Source NAT changes the source address of packets that leave a network.

Private addresses cannot be routed on the Internet. A router with one public address can let many private hosts share it, by replacing each private source address with the public one.

RouterOS offers two actions for this job. Masquerade is the simple one for a changing public address. src-nat is the explicit one for a fixed public address.

How it works

The rule sits in the srcnat chain, rewrites the source of outgoing packets, and connection tracking handles the replies.

The srcnat chain

The NAT table has a srcnat chain. It is checked after the routing decision, when the router knows which interface the packet will use.

/ip firewall nat print

A rule matches packets by properties such as the source network and the outgoing interface. The action then rewrites the source address.

Only the first packet of a connection goes through the NAT rules. Connection tracking remembers the translation, and it applies it to the rest of the packets. It also reverses the translation for the replies, so the private host receives them.

Masquerade

Masquerade replaces the source address with the address that the outgoing interface has at that moment.

/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade

This rule suits a WAN interface whose address can change, such as one that gets its address from a DHCP client or a PPPoE server. The rule does not name an address, so it follows the interface when the address changes.

Masquerade matches on the interface, so the out-interface setting is the key parameter. Without it the rule would match traffic going anywhere, including traffic that stays on the LAN.

You can narrow the rule further by source network.

/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 out-interface=ether1 action=masquerade

Exam tip

Use masquerade on interfaces with a dynamic address, and name the WAN interface in out-interface.

The src-nat action

The src-nat action replaces the source address with an address that you specify.

/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 out-interface=ether1 action=src-nat to-addresses=203.0.113.10

The to-addresses parameter holds the new source address. It can also be a range, and the router then picks from it. The to-ports parameter can set the source port range, but it is rarely needed.

Use src-nat when the public address is fixed. It is slightly more efficient than masquerade, because the router does not need to look up the interface address.

It is also the right choice when you want a specific host or network to appear with a particular public address, for instance when a server farm uses a separate address from the office users.

/ip firewall nat add chain=srcnat src-address=192.168.88.50 action=src-nat to-addresses=203.0.113.11

Masquerade or src-nat

Question	Masquerade	src-nat
Public address changes	Follows the interface	Needs the rule edited
Address is given in the rule	No	Yes, with `to-addresses`
Typical use	DHCP, PPPoE or LTE WAN	Fixed public address
Names `out-interface`	Strongly recommended	Recommended

If the address never changes, either action works. If it can change, masquerade is the safer choice.

Checking the NAT

/ip firewall nat print stats
/ip firewall connection print

The counters show whether the rule is matched. The connection table shows both the original and the translated addresses of each connection.

If hosts on the LAN cannot reach the Internet, check the order of the checks:

The router itself reaches the Internet.
The LAN host has the router as its gateway.
A srcnat rule exists and its counters grow.
The out-interface is the WAN, and not the LAN.

Watch out

A masquerade rule without an out-interface also rewrites traffic that stays inside your network, which can break local communication.

What to remember for the exam

Seven facts cover this topic.

Source NAT replaces the source address of outgoing packets, in the srcnat chain.
Connection tracking applies the translation to the rest of the connection and reverses it for replies.
Masquerade uses the current address of the outgoing interface.
Use masquerade when the public address is dynamic.
The src-nat action needs to-addresses, and it suits a fixed public address.
Name the WAN interface with out-interface.
Private hosts need a srcnat rule to reach the Internet.

Common mistakes

These four mistakes are common.

Leaving out the out interface. The rule matches too much traffic and can disturb local traffic.

Using the wrong interface. Naming the LAN interface means the rule never matches Internet traffic.

Using src-nat with a changing address. When the address changes, the rule translates to an address that is no longer there.

Forgetting the rule altogether. The hosts then send private source addresses that the Internet will not route back.

Check yourself

Work through these three questions.

When do you choose masquerade instead of src-nat?
Choose masquerade when the public address changes, for example from DHCP or PPPoE. It uses whatever address the outgoing interface has.
Which parameter holds the new source address in a src-nat rule?
to-addresses holds it. The rule is action=src-nat in the srcnat chain.
Why do replies reach the private host after source NAT?
Connection tracking remembers the translation. It reverses it for the reply packets.

Topic 4 of 6 in Firewall

Test yourself on Firewall

The full MikroTik MTCNA question bank has 558 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.