Firewall Filter, NAT and Mangle · Topic 3 of 6

NAT Chains, Actions and Conditions

Learn RouterOS NAT: the dstnat and srcnat chains, custom chains, every NAT action such as masquerade, dst-nat, redirect and netmap, and common conditions.

5 min
Includes a diagram

In a nutshell

NAT has two default chains: dstnat and srcnat.
Only the first packet of a connection is checked against the NAT table.
Replies are translated back through the tracked connection, so no reply rule is needed.

What it is

NAT rewrites the addresses or ports of packets as they pass through the router.

The usual reason is address shortage. Private LAN addresses cannot be routed on the internet, so the router replaces them with its public address on the way out. In the other direction, NAT can send incoming connections to a server inside the LAN.

RouterOS has two kinds of NAT: source NAT changes the source, and destination NAT changes the destination. The rules are in /ip firewall nat.

How it works

NAT depends on connection tracking, and only the first packet of a connection is checked against the NAT rules.

The chains

A router with a LAN host at 192.168.88.10 and a web server at 192.168.88.50; outbound traffic has its source changed to 203.0.113.10 by srcnat, and inbound traffic to 203.0.113.10 port 80 is changed by dstnat to 192.168.88.50 port 8080.

Chain	Runs	Changes
dstnat	In prerouting, before the routing decision	The destination address or port
srcnat	In postrouting, after the routing decision	The source address or port

Custom chains work as in the filter table. A rule with action=jump and a jump-target sends the packet to the custom chain, and return goes back.

Only the first packet of a connection is compared with the NAT table. The result is stored in the tracked connection, and every later packet and every reply follows that stored result. This is why you never write a rule for the reply direction.

NAT actions

Action	Effect
src-nat	Replace the source with a fixed address, given in `to-addresses`, and optionally `to-ports`
masquerade	Replace the source with the address of the outgoing interface
dst-nat	Replace the destination with `to-addresses` and optionally `to-ports`
redirect	Send the packet to the router itself, with an optional `to-ports`
netmap	Map one network onto another, address for address
same	Give each client the same address from a range every time (not present in every version)
accept	Skip further NAT rules for this packet
jump, return	Move into or out of a custom chain
passthrough	Count the packet and move on
log	Write a log entry and move on
add-src-to-address-list, add-dst-to-address-list	Store the address in a list

Masquerade versus src-nat

Both change the source address, and both work in srcnat. The difference is how they pick the new address.

/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade
/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 out-interface=ether1 action=src-nat to-addresses=203.0.113.10

Masquerade reads the address from the outgoing interface, so it suits a WAN address that changes, such as one from DHCP. When the interface address changes or the link goes down, the related connections are removed. Src-nat uses a fixed address, so it suits a static public address.

Destination NAT and redirect

Dstnat publishes an inside server. Redirect is a special case where the target is the router itself, for example to push all web requests to a local service.

/ip firewall nat add chain=dstnat dst-address=203.0.113.10 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50 to-ports=8080
/ip firewall nat add chain=dstnat in-interface=ether2 protocol=udp dst-port=53 action=redirect to-ports=53

A dstnat rule does not open the firewall. A forward filter rule must still allow the translated traffic.

Netmap and same

Netmap translates a whole network to another of the same size, keeping the host part. It is used for one to one mappings. The same action picks an address from a range and keeps using it for the same client, which helps services that dislike changing source addresses.

Common conditions

The conditions are the same style as in filter. The most useful ones for NAT are src-address, dst-address, protocol, src-port, dst-port, in-interface, out-interface and dst-address-type.

Srcnat rules use out-interface because the output is known after routing. Dstnat rules use in-interface because the input is known at the start. The condition dst-address-type=local matches addresses that belong to the router, which suits dstnat rules on a WAN with a changing address.

Exam tip

Use out-interface in srcnat rules and in-interface in dstnat rules, so the rule matches only on the correct side of the router.

What to remember for the exam

Eight facts cover most questions on this topic.

NAT has two default chains: dstnat and srcnat.
Only the first packet of a connection is checked against the NAT table.
Replies are translated back through the tracked connection, so no reply rule is needed.
masquerade takes the address of the outgoing interface. src-nat uses to-addresses.
dst-nat publishes an internal server with to-addresses and to-ports.
redirect sends the packet to the router itself.
netmap maps one network onto another.
A dstnat rule needs a matching forward filter rule if the firewall drops by default.

Watch out

Masquerade removes connections when the outgoing interface address changes. Do not use it where long connections must survive an address change.

Common mistakes

These four mistakes appear often.

Choosing masquerade without an out-interface. The rule then matches traffic on every interface.

Forgetting the filter rule. A dstnat rule alone does not allow the translated traffic through the forward chain.

Using srcnat for incoming traffic. Publishing a server needs dstnat, because the destination must change.

Writing a rule for the reply. Connection tracking handles it, so a second rule is extra work.

Check yourself

Work through these three questions.

Which NAT action suits a WAN interface whose address changes?
masquerade, because it takes the address from the outgoing interface.
Why is no NAT rule needed for reply packets?
Only the first packet is checked, and the stored result in connection tracking translates later packets and replies.
Which action sends traffic to the router itself?
redirect, optionally with to-ports.

Topic 3 of 6 in Firewall Filter, NAT and Mangle

Test yourself on Firewall Filter, NAT and Mangle

The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.