Application Example with Masquerading

If you want to 'hide' the private LAN 192.168.0.0/24 'behind' one address 10.1.1.12 given to you by the ISP, you should use the masquerading function of the MikroTik router. Masquerading is useful, if you want to access the ISP's network and the Internet appearing as all requests coming from the host 10.1.1.12 of the ISP's network. The masquerading will change the source IP address and port of the packets originated from the network 192.168.0.0/24 to the address 10.1.1.12 of the router, when the packet is routed through it.

Masquerading helps to ensure security since each outgoing or incoming request must go through a translation process that also offers the opportunity to qualify or authenticate the request or match it to a previous request. Masquerading also conserves the number of global IP addresses required and it lets the whole network use a single IP address in its communication with the world.

To use masquerading, a firewall rule with action 'masq' should be added to the forward chain of the router's firewall configuration:

[MikroTik] ip firewall rule forward>
add action=masq interface=Public src-address=192.168.0.0/24
[MikroTik] ip firewall rule forward>                                          
Flags: X - disabled, I - invalid
 0   protocol=all src-address=192.168.0.0/24:0-65535
     dst-address=0.0.0.0/0:0-65535 interface=Public action=masq
     tcp-options=all log=no

[MikroTik] ip firewall rule forward>