I have the following problem: a customer have several LANs, for example LAN1, and LAN2 with the same private IP ranges (192.168.10.x), and I need to monitor all the networks.

I have name three interfaces of the router like this: LAN1, LAN2 and MONITOR

What I need to do is a one-to-one NAT from LAN1 to MONITOR,and other from LAN2 to MONITOR. The NAT configuration should look like this:

I need to be able to access from MONITOR to LAN1, and from MONITOR to LAN2. In the monitor I can use any range I want. To make the example easy to read, let's suppose I have the in MONITOR LAN. So, what I need to do is to hide the private addresses of LAN1 and LAN2, like this:

  • LAN1 ip address hidden as
  • LAN2 ip address hidden as

In this way I can access the machine on LAN1 using the address, and the machine (same IP) on LAN2 using the address (note the mapping 10.0.1.x for LAN1, 10.0.2.x for LAN2)

I need to define a NAT for LAN1 like this

/ip firewall nat add chain=dstnat dst-address= \
  action=netmap to-addresses=

/ip firewall nat add chain=srcnat src-address= \
  action=netmap to-addresses=

(Obviously for LAN2, I use a similar NAT definition)

So far so good. If I use this NAT definition for LAN1, everything works as expected.

The problem is when I define the NAT for the second LAN. I have tried bridging, routing with mangled packets, using VLANs... but none of my configurations give me the expected results. For example, if I ping the pings sometimes arrive the machine on LAN1, and other occassions I get the pings from the machine with the same IP on LAN2. On other occassions the routes fail (there's some problem with them).

I don't mind if i have to use routing or bridging. I don't mind what IPs I use on the MONITOR LAN, but what I cannot do is to change the IPS on LAN1 and LAN2.

In a few words, what I need is to assign a NAT from MONITOR interface to LAN1 interface for to, and another NAT from MONITOR interface to LAN2 for to I have not been able to separate the traffic for both "channlels", because of the repeated IPs on LAN1 and LAN2.

Do you have any idea of how I can achieve it?

1 Answer 1


Let's go to a easy solution: I understand that your router is, so :

/ip firewall nat add chain=srcnat src-address= dst-address= action=src-nat to-addresses="router-IP-192.168.10.x/24" /ip firewall nat add chain=srcnat src-address= dst-address= action=dst-natp to-addresses="router-IP-192.168.10.x/24"

Make sure that all of PC/Servers have set Router-ip default gateway

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .