Learn.GTArsenals
Search

NAT Not Working

Diagnosing why private LAN addressing isn't being translated correctly for Internet access.

NAT issues usually manifest as LAN clients being able to ping the router, but unable to ping public IP addresses like 8.8.8.8 (resulting in a “Request Timed Out”).

1. Confirm NAT is applied to the correct interface

Masquerade (Source NAT) needs to be applied to the exact interface traffic exits through. If you use a PPPoE client (pppoe-out1), the out-interface must be pppoe-out1, not the underlying physical port (ether1).

CLI Check:

/ip firewall nat print
# Look at the 'out-interface'. Does it match your actual active WAN connection?

2. Check the rule chain and action

For LAN devices reaching the internet, the rule must be in the srcnat chain, and the action must be masquerade or src-nat.

CLI Check:

/ip firewall nat print detail
# Ensure you see: chain=srcnat action=masquerade out-interface=...

If you accidentally put it in the dstnat chain, it won’t work.

3. Clear Connection Tracking

If you recently changed your NAT rule (e.g., you realized the interface was wrong and fixed it), existing connections might still be stuck using the old, broken NAT path.

WinBox Procedure: Go to IP -> Firewall -> Connections. Select all and click - (Remove).

CLI Procedure:

/ip firewall connection remove [find]

Try pinging 8.8.8.8 again.

4. Confirm routing and the firewall aren’t the actual problem

NAT only translates traffic; it doesn’t route it. Before assuming NAT is broken, confirm the router actually has a default route to the internet.

/ip route print
# Ensure you have a reachable 0.0.0.0/0 route.

5. Port Forwarding (Destination NAT) Failures

If you are trying to host a server (like a web server or game server) and people outside can’t reach it, you are dealing with Destination NAT (dstnat).

Common causes for port forwarding failures:

  1. Wrong Chain: Must be chain=dstnat.
  2. Missing Firewall Rule: Creating a NAT rule does not automatically punch a hole in the firewall. You must also have a rule in IP -> Firewall -> Filter Rules on the forward chain allowing the traffic (e.g., action=accept connection-nat-state=dstnat).
  3. ISP CGNAT: If your WAN IP (check /ip address print) is in the 100.64.0.0/10 range, your ISP is using Carrier-Grade NAT. You cannot port forward on a CGNAT connection unless you ask your ISP for a static, public IP.