Skip to content
MikroTik RouterOS Docs

Basic NAT Masquerade Configuration

Basic NAT Masquerade Configuration

Section titled “Basic NAT Masquerade Configuration”

TL;DR (Quick Start)

Section titled “TL;DR (Quick Start)”

For the impatient: here’s the 30-second version.

# Basic masquerade for internet access
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

Overview

Section titled “Overview”

This guide demonstrates how to configure NAT masquerade on MikroTik RouterOS to allow internal network devices to access the internet through the router.

Prerequisites

Section titled “Prerequisites”
  • A MikroTik router running RouterOS 7.x or later
  • Access to the router via SSH, WinBox, or WebFig

Configuration Steps

Section titled “Configuration Steps”

Step 1: Add Masquerade Rule for Outgoing Traffic

Section titled “Step 1: Add Masquerade Rule for Outgoing Traffic”

Configure masquerade NAT for traffic leaving through ether1 (WAN interface):

/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 comment="Masquerade for WAN"

Step 2: Add Source NAT for Specific Network

Section titled “Step 2: Add Source NAT for Specific Network”

Add a masquerade rule specifically for the LAN subnet:

/ip firewall nat add chain=srcnat action=masquerade src-address=192.168.88.0/24 comment="Masquerade LAN network"

Step 3: Add Destination NAT (Port Forward)

Section titled “Step 3: Add Destination NAT (Port Forward)”

Forward external port 8080 to an internal web server:

/ip firewall nat add chain=dstnat action=dst-nat protocol=tcp dst-port=8080 to-addresses=192.168.88.100 to-ports=80 comment="Port forward to webserver"

Verification

Section titled “Verification”

Check 1: NAT Rules

Section titled “Check 1: NAT Rules”
/ip firewall nat print

Expected Output:

Flags: X - disabled, I - invalid, D - dynamic
 0    chain=srcnat action=masquerade out-interface=ether1 log=no
      log-prefix="" comment="Masquerade for WAN"


 1    chain=srcnat action=masquerade src-address=192.168.88.0/24 log=no
      log-prefix="" comment="Masquerade LAN network"


 2    chain=dstnat action=dst-nat to-addresses=192.168.88.100 to-ports=80
      protocol=tcp dst-port=8080 log=no log-prefix=""
      comment="Port forward to webserver"

Check 2: Connection Tracking

Section titled “Check 2: Connection Tracking”
/ip firewall connection print where nat-dst-address!=""

Expected Output (when traffic is flowing):

Flags: S - seen-reply, A - assured
 #   PROTOCOL  SRC-ADDRESS           DST-ADDRESS           TCP-STATE
 0 SA tcp      203.0.113.50:54321    192.168.88.100:80     established

Troubleshooting

Section titled “Troubleshooting”

Problem: Internal devices can’t access internet

Section titled “Problem: Internal devices can’t access internet”

Symptoms: LAN devices cannot reach external websites or services.

Causes & Solutions:

  1. Wrong out-interface - Verify the interface name matches your WAN:

    /interface print where running
    /ip firewall nat print

    Ensure the out-interface in your masquerade rule matches your actual WAN interface.

  2. Missing default route - Check routing table:

    /ip route print where dst-address=0.0.0.0/0

    You need a default gateway pointing to your ISP.

  3. Firewall blocking traffic - Check forward chain:

    /ip firewall filter print chain=forward

    Ensure LAN-to-WAN traffic is not being dropped.

Problem: Port forward not working

Section titled “Problem: Port forward not working”

Symptoms: External users cannot reach internal services via port forward.

Causes & Solutions:

  1. ISP blocking port - Try a different port number to test.

  2. Firewall rule missing - NAT changes destination but firewall still applies:

    /ip firewall filter add chain=forward action=accept protocol=tcp dst-port=80 dst-address=192.168.88.100

  3. NAT rule order - Ensure dstnat rules come before masquerade in the chain.

Problem: Hairpin NAT not working

Section titled “Problem: Hairpin NAT not working”

Symptoms: Internal devices can’t access internal server using external IP.

Causes & Solutions:

  1. Need srcnat rule for internal traffic: 
    /ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.100 protocol=tcp dst-port=80 action=masquerade

Problem: Connection tracking table full

Section titled “Problem: Connection tracking table full”

Symptoms: New connections fail, logs show “nf_conntrack: table full”

Causes & Solutions:

  1. Increase tracking limit:

    /ip firewall connection tracking set max-entries=65536

  2. Reduce timeouts for idle connections:

    /ip firewall connection tracking set tcp-established-timeout=1d
Section titled “Related Topics”

Prerequisites

Section titled “Prerequisites”
Section titled “Related Firewall Topics”

Services That Need NAT

Section titled “Services That Need NAT”

References

Section titled “References”