NAT and Masquerade in MikroTik: Sharing Internet Access

NAT and Masquerade on MikroTik: Sharing Your Internet Connection

NAT (Network Address Translation) is the technology that allows many devices on your private network to share a single public IP address from your ISP. Without NAT, every device would need its own public IP — which is impractical and expensive. This guide explains how NAT works and how to set it up on RouterOS.

How NAT Works (The Simple Explanation)

Imagine your home network uses IP addresses like 192.168.1.x. These are private addresses that cannot be routed on the public Internet. Your ISP gives your router a single public IP like 203.0.113.1.

Without NAT, when your laptop (192.168.1.10) tries to visit a website, the website would not know where to send the reply — it cannot reach 192.168.1.10 because that address is private.

With NAT (specifically Source NAT, also called masquerade):

1. Your laptop sends a packet from 192.168.1.10:54321 to 93.184.216.34:80
2. Your router replaces the source address with its public IP: 203.0.113.1:54321
3. The website replies to 203.0.113.1:54321
4. Your router remembers the original connection and forwards the reply back to 192.168.1.10:54321

The router acts as a translator between your private network and the Internet.

Source NAT vs Destination NAT

• Source NAT (SNAT/Masquerade) — changes the source IP of outgoing packets. Used for Internet sharing.
• Destination NAT (DNAT/Port Forward) — changes the destination IP of incoming packets. Used to forward specific ports to internal servers.

This lesson focuses on Source NAT (masquerade).

Setting Up Masquerade in RouterOS

The command is simple:

/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1 comment=masquerade-for-internet

Parameters explained:

• chain=srcnat — this is a Source NAT rule (changes source address)
• action=masquerade — automatically uses the current IP of the out-interface (perfect when your ISP IP changes dynamically)
• out-interface=ether1 — apply this rule when traffic exits through ether1 (your WAN/Internet interface)
• comment=masquerade-for-internet — optional label

That single rule is all you need for basic Internet sharing!

Verifying the NAT Rule

/ip firewall nat print

Output example:

Flags: X - disabled, I - invalid, D - dynamic
 0    chain=srcnat action=masquerade out-interface=ether1

Why masquerade Instead of src-nat?

There are two actions that do Source NAT:

• action=masquerade — automatically uses whatever IP the out-interface currently has. Best when your ISP gives you a dynamic IP (it changes sometimes).
• action=src-nat to-addresses=203.0.113.1 — you specify the exact IP to NAT to. Better for static IP addresses (slightly more efficient).

For most beginners and home setups, use masquerade. It just works.

Adding More Specificity to the NAT Rule

For better control, you can restrict the masquerade rule to only apply to traffic from your LAN:

/ip firewall nat add chain=srcnat src-address=192.168.1.0/24 action=masquerade out-interface=ether1

This only masquerades packets that originated from the 192.168.1.0/24 subnet. Traffic from other sources is not affected.

How to Check If NAT Is Working

After adding the masquerade rule, try pinging the Internet from your MikroTik:

/ping 8.8.8.8 count=4

If this works, the router itself has Internet access. Now check from a client device on your LAN — if the client can reach the Internet, NAT is working.

To see NAT connections in real time:

/ip firewall connection print

This shows all active connection tracking entries.

Port Forwarding (Destination NAT) — Brief Overview

If you want to host a server (for example a web server on 192.168.1.100 port 80), you need to forward incoming traffic from the WAN to the internal server:

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.1.100 to-ports=80

Parameters:

• chain=dstnat — Destination NAT rule
• in-interface=ether1 — apply when traffic arrives on ether1 (WAN)
• protocol=tcp dst-port=80 — only for TCP port 80 (HTTP)
• action=dst-nat to-addresses=192.168.1.100 to-ports=80 — send it to internal server

Full Example: Home Network NAT Setup

Assume: ether1 is WAN (DHCP from ISP), ether2 is LAN (192.168.1.1/24):

# WAN gets IP from ISP via DHCP
/ip dhcp-client add interface=ether1 disabled=no

# LAN address
/ip address add address=192.168.1.1/24 interface=ether2

# Default route (gets added automatically by DHCP client, but manually:)
# /ip route add dst-address=0.0.0.0/0 gateway=<ISP-GATEWAY>

# Masquerade for Internet sharing
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

Common Mistakes

Forgetting the Default Route

NAT only handles address translation. Your router still needs to know where to send Internet traffic — you need a default route pointing to your ISP gateway. DHCP client adds this automatically. If using a static IP, add it manually:

/ip route add dst-address=0.0.0.0/0 gateway=203.0.113.254

Wrong Interface in the NAT Rule

Make sure out-interface matches your actual WAN interface name. Use /interface print to confirm.

NAT Rule Too Broad or Not Broad Enough

If you add src-address restrictions, make sure they cover all your LAN subnets.

Summary

Source NAT (masquerade) on MikroTik is set up with one command:

/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

This single rule allows all devices on your LAN to share your public IP address and access the Internet. For dynamic ISP IPs, masquerade is the correct action to use.