Syed Jahanzaib Personal Blog to Share Knowledge !

March 27, 2018

Separating NATTING from ROUTING in Mikrotik

Filed under: Mikrotik Related — Tags: — Syed Jahanzaib / Pinochio~:) @ 10:57 AM

nattinv and routing brother.jpg

no nat result

mikrotik natting and routing


Every Network is different , so one solution cannot be applied to all. Therefore try to understand logic & create a solution that can match with your network scenario. Do not follow copy paste blindly.

I am NOT certified in anything Mikrotik/Cisco/Linux or Windows. However I have worked with some core networks and I read & research & try stuff all of the time. So I am not speaking/posting about stuff I am formerly trained in, I pretty much go with experience and what I have learned on my own. And , If I don’t know something then I read & learn all about it.

So , please don’t hold me/my-postings to be always 100 percent correct. I make mistakes just like everybody else. However – I do my best, learn from my mistakes and always try to help others

Syed Jahanzaib


We are using Mikrotik CCR as PPPOE NAS. It’s a mix match scenario where large number of users receive private ip (via pppoe connection) and smaller number of users gets public ip (routed Public pool)


When we have network outages like light failure in any particular area OR port flaps, in LOG we can see many PPPoE sessions disconnects with ‘peer not responding‘ messages. Exactly at this moments, our NAS CPU usage reaches to almost 100% , which results in router stops passing any kind of traffic. This problem continues for 2-3 minutes.

As shown in the image below …

pppoe high cpu usage

After lurking in the mikrotik forums, I was informed that If you are using Masquarade /NAT on the router, that is the problem. When using Masquarade, RouterOS has to do full connection tracking recalculation on EACH interface connect/disconnect. So if you have lots of PPP session connecting/disconnecting, connection tracking will constantly be recalculated which can cause high CPU usage. When interfaces connect/disconnect, in combination with NAT, it gives you high CPU usage.

Solution OR Possible Workaround :

  • If you have lots of PPP users along with some NATTING rules, Stop using Masquarade on same router that have a lot of dynamic interfaces. DO NOT use NAT on any router that have high number of connecting/disconnecting interfaces , like pppoe/vpn. Place an additional router connected with your PPPoE NAS, and route NAT traffic there. Make sure to disable CONNECTION TRACKING on PPPoE NAS router.

Example: Add another router & perform all natting on that router by sending marked traffic from private ip series to that nat router. Setup routing between the PPPoE NAS and the NAT router.Make sure to disable CONNECTION TRACKING on PPPoE NAS router.

Following is an working example.

1# Main CCR as PPPOE NAS

Interface Details:

  • ETHER1-LAN-: < User facing interface where pppoe connections establishes. Consider it as LAN facing side for pppoe users.
  • PUBLIC-WAN: < WAN Interface for public IP routing
  • 2-NAT-ROUTER:  < interface connected with another CCR for natting traffic routing
  • PPPoE User IP Pool >
  • UPSTREAM ISP Core Router Gateway IP >

2# Second CCR as NATTING Router

Interface Details:

  • 2nd-NAT-CCR-LAN: < interface connected with main CCR [for pppoe users traffic]
  • NATTING-WAN: < Wan interface for natting users [traffic coming from main CCR for natting]
  • UPSTREAM ISP Core Router Gateway IP >
  • PPPoE Users Pool –

1# Main CCR Configuration for marking traffic

First we will mark traffic for private/public ip and will create routes for them as well.

/ip firewall mangle
add action=mark-routing chain=prerouting comment="Mark routing for Private IP users - zaib" disabled=no new-routing-mark=nat_routing passthrough=yes src-address=
# We really dont need to mark traffic for public ip's because they will simply pass from our default route , but just for the sake of demonstration we are doing it.
add action=mark-routing chain=prerouting comment="Mark routing for PUBLIC IP users - zaib" disabled=no new-routing-mark=public_routing passthrough=yes src-address=

Make sure you dont have any NAT rule in place. [in NAT section]

Now add Routes for marked traffic

/ip route
add comment="Route private ip traffic via second NAT router" disabled=no distance=1 dst-address= gateway= routing-mark=nat_routing scope=30 target-scope=10
add comment="Route public ip via this router default Gateway" disabled=no distance=1 dst-address= gateway= routing-mark=public_routing scope=30 target-scope=10
# DEFAULT Gateway for router's own traffic - zaib
add check-gateway=ping disabled=no distance=1 dst-address= gateway= scope=30 target-scope=10

Main CCR configuration part is done. Now moving towards second router where all NATTING will be done.

2# NATTING CCR Configuration for Masquerade

First create Default NAT rule [you may want to add ip series for security purposes.

/ip route
add comment="Default Router for NATTING router " disabled=no distance=1 dst-address= gateway= scope=30 target-scope=10
# Add reverse Route so that NATTING router can see the pppoe user directly
add disabled=no distance=1 dst-address= gateway= scope=30 target-scope=10

Testing !

  • Create TEST user in main CCR pppoe NAS,
  • Assign him private ip series profile,
  • Connect this TEST id from test PC & run TRACEROUTE

As shown in the image below …

ccr pppoe active private.JPG



RUN Torch on NATTING Router… as we can see that NATTING router is seeing pppoe users directly dueto reverse route in it.


Final Step.

Once you have routed all private ip series 2 2nd CCR, Make sure to disable CONNECTION TRACKING on the pppoe router (1st router where users are connected via pppoe) by using cmd

/ip firewall connection tracking
set enabled=no

Now look at the difference Before Vs After

no nat result


    • Mr. Zaib
      You did some typo mistake on IP, as you mention on the LAN Card


      Comment by kashifzai86 — April 10, 2019 @ 9:17 AM

      • Yes it was a typo because lab was done separate session, and guide was written on different lab. Thank sfor pointing


        Comment by Syed Jahanzaib / Pinochio~:) — April 10, 2019 @ 9:44 AM

  1. We need Load Balance Proper, Give me help

    On 27 March 2018 at 11:28, Syed Jahanzaib Personal Blog to Share Knowledge ! wrote:

    > Syed Jahanzaib / Pinochio~:) posted: ” Disclaimer: Every Network is > different , so one solution cannot be applied to all. Therefore try to > understand logic & create a solution that can match with your network > scenario. Do not follow copy paste blindly. I am NOT certified in anything > Mi” >


    Comment by wifi lakhani — March 27, 2018 @ 11:59 AM



      Comment by waqas hussain — March 28, 2018 @ 5:30 PM

  2. hi syed, help, this script for multiple wan interfaces


    Comment by antonino — April 9, 2018 @ 6:40 PM

  3. Hi. I hope you can help me. My network diagram is on this address.

    I have having problems on how to NAT my public IPs so that each client will use 2 different public IP. My ISP routes 3 public IP to my router over PPPOE. And my clients routers are connecting to my network through the PPPOE Server. How do I accomplish this? I am able to NAT one public IP but both clients use the same public IP. I want them to use different public IPs. Is it possible?


    Comment by Oliver Mercado — August 25, 2018 @ 6:14 PM

  4. Hi

    I have a problem on Main PPPOE server.

    I configured it pppoe server. Pppoe Clients are ok with ip
    On the interface that is pppoe server i have some CRS, Access point Mikrotik, AP UBIQUITI. (all those are in ip range example MIKROTIK AP , UBIQUITI AP
    I have a route where I route all this to nat server. dst-address= gateway=NAT IP
    On this pppoe server i can ping all my devivces mikrotik ap or ubiquiti. I can manage from here with telnet and ssh

    Problem. A client connected here to this pppoe server is getting ip All is ok.
    I Do traceroute and it is shown
    hop1: internal ip of client router
    hop3: NAT IP
    hop4: Gateway of my ISP Provider

    ………GOOGLE IP

    Internet is all ok on all ppppoe clients

    But if i want to manage an Access point in my network i can only manage Ubiquity.
    When i ping from client side i can ping ubiquiti but cant ping mikrotik devices.
    I do traceroute from client and I get
    for ubiquiti
    Hop 1:
    Hop 2:

    for Mikrotik
    Hop 1:
    Hop 2: Timeout

    Problem 2: On the nat side. I have only a firewall (masquerade). I dont have any filters or mangle. nathing only masquerade.

    In the route section i have the default gateway of my isp and i add static routes to see pppoe clients directly and static route for my ap

    static route are

    dst-address= gateway=ISP Gateway
    dst-address= gateway=PPPOE SERVER IP
    dst-address= gateway=PPPOE SERVER IP

    I can ping all clients. when i want to ping my ap that are behind pppoe server i can ping and manage only ubiquity. I cant ping and manage mikrotik devices..

    What i am missing ?

    Best Regards


    Comment by Rinush Stavri — August 27, 2018 @ 3:50 PM

  5. Dear Jahanzaib

    I tried to perform Routing After seeing this post but can able to do it, I had also shared my issue to Mikrotik Forum below is the link for your review and suggestion, All are welcome



    Comment by kashifzai86 — November 13, 2019 @ 7:29 PM

  6. Can we record logs of the users with this method ?


    Comment by Saurabh — July 29, 2020 @ 11:30 AM

  7. Dear Jhanzaib bhai

    When connection tracking is OFF on Routing EDGE Router then how can we implement DDOS attack rules??? becoz when user getting real/ public IP, DDOS attack form outside are possible. I’m getting surely getting this issue from few days


    Comment by kashifzai86 — December 27, 2020 @ 3:06 PM

  8. […] in Tik freezing for a minute or more causing other users disconnection, creating looping as well. Use separate router for natting. If you have high number of PPP users along with some NATTING rules, Stop using Masquarade on same […]


    Pingback by Possibilities: Mikrotik PPP Disconnection/Yellow Sign Problems | Syed Jahanzaib Personal Blog to Share Knowledge ! — January 21, 2021 @ 9:58 AM

  9. A.O.A sir i follow all the steps and deploy in my network everything is working fine and well, but the little problem I face in my network is some subnets are not pingable and no communicating each other these subnets is for management purpose only kindly help me how can i solve this issue thank you.


    Comment by ali — January 25, 2022 @ 2:35 PM

    • each subnet mus thave default gateway pointing to either mikrotik or intervaln routing switch where all subnet records are maintained. in short client must have the info (either via default gateway or classless dhcp routes) to connect with each other.


      Comment by Syed Jahanzaib / Pinochio~:) — January 27, 2022 @ 10:58 AM

  10. it works well THANKS , i have 2 questions about this, 1- in natting router should i add out-inteterface to the masquerade rules ?, 2 – if we have 3 masquerade rules in natting router 1 rule for normal clients, 1other rule for ip tv clients to provide 2sc connection and 1 rule for Expired users to allow DST address to them is this ok ? or should i find way to make them 1 rule ?


    Comment by Safe — March 19, 2022 @ 8:39 AM

  11. Thanks Work perfect
    if we have only PPPOE take i should not add any mangle rules ?


    Comment by ahmed — March 22, 2022 @ 7:34 AM

  12. Hey to All Experts here

    I m getting an issue after disabling Connection Tracking, non of my Filter Rules are working Except “Accept Rules”, Please do let me know the issue,


    Comment by kashifzai86 — June 23, 2022 @ 9:35 AM

  13. mere pass 1 issue ah reha hai..
    NAT wale users PPTP Client use nei ker paa rehe. NAT se pass nei ho rehe PPTP clients .


    Comment by Hamza — October 9, 2022 @ 4:49 PM

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: