Network Address Translation - NAT secrets they didn't teach you

Network Address Translation (NAT) is something we use every day. Many people think they know how it works, but they don't. This time Druvis looks under the hood and all becomes clear - NAT explained!
0:00 Intro
0:18 NAT origins
1:26 The missing piece
3:43 Masquerade under the hood
5:57 Endpoint Independent Mapping
6:30 Secret Masquerade
7:06 Grand Summary
8:50 Outro

[@ollisollis]

Great Video, but reduce the volume of music. Please.

[@stevenm45]

Yes, broadcast sound engineer here! Please re-mix to drop the background music by 10dB or so. Other than that I just learnt some extra stuff about NAT, thank you MT!

[@mikkio5371]

😂​😂

[@krusher00]

And 9:20 🎉

[@stephanszarafinski9001]

Great video! I like it that you explain not only the basic things, but also more in depth stuff. That way the video is interesting for both beginners and more advanced users. Good visuals too!

[@matelotjim9035]

Another great video Druvis, explaining the bits that others miss.

[@user-zb2qm7gn7w]

Still missing ipv6 videos.

[@bartomiejsikora910]

Hi MikroTik Guys. We need more videos like this. Thanks .

[@maxvideodrome4215]

Nice work again Mikrotik - really enjoy your products.

[@philippeastier7657]

Thank you again, those series of videos are just great.

[@vladislavkaras491]

I don't know if there is anything interesting and/or complicated in bridging adapters together, but if there is, would be interesting to watch it! Thanks for such great video!

[@DeFi-Macrodosing]

You guys are great, and your devices too. I'd never heard of you before, until I got my ATL LTE router. Amazing. I'd love to know more about customising the router's firewall.

[@kolifx]

Great video, concise and clear. Great follow up would be to explain how Zerotier can help if one (or both) networks is/are behind CG NAT.

[@drumaddict89]

since MT is a routing/router company ... more videos on BGP. basics, case studies, best practices, v7 limitations and BGP in-depth with routerOS! BGP needs to get more love at mikrotik again. also MPLS/VPLS case studies or tutorials would be great in context of ROSv7 configurations

[@chadtaylor1148]

I have a /24 of public IP it was breeze to set up on VULTR with ROS6 but 7 has been a no go I absolutely cannot get it to announce. So I would very much love to see some more examples of BGP in version seven.

[@drumaddict89]

@@chadtaylor1148 not examples alone ... improvements and features which are there in v6 !!!

[@erlonsilva3396]

Currently version 7 is behaving like other manufacturers. You must have your prefix in the FIB so that it can be announced. In fact, not only that, but you need to create an addres-list with it and also send it in the out (export) filter.

[@LuisAriasSanchez]

Un material excelente. Muchas gracias.

[@gcinini]

Great video. Also loved the VLAN series. If you guys could go deeper with the VLAN videos presenting specific scenarios to increase security in home LANs leveraging VLANS and multiple Wi-Fi networks or other similar scenarios that would be great! Keep up the great work.

[@mikrotik]

Noted

[@FranciscoMatusCL]

amazing content, thanks for your effort!

[@mikrotik]

Glad you enjoy it!

[@leratoradebe6438]

Great video, certainly learnt something!

[@SiBex_ovh]

Nice Music, this is a next level of video's :). I remember when in past, we use a Public IP on all internal PC. Police in Poland use Dual PC (one PC with Internet, second PC internal network). Those time was awesome, so big wow effect was in every category in IT.

[@mikrotik]

Thanks for the cool story from the old times. We will try to make more good videos :)

[@Micheph]

Saved me rereads. Do not forget to remind us who are just users why it is important to read Mikrotik block diagrams.

[@vitea1]

Good video. Will be great to see video about DS-lite and IPv6

[@CarmineIannace]

Excellent video! Paldies!

[@brucemoriarty]

amazing video and very informative :D

[@jesusmedina-oi7sl]

Great video, make another one explaining load balancing techniques.

[@SecOps-7]

Thanks for the great video. Would love to see a video on WiFi configuration best practices, especially Radio wave frequency best practices on Mikrotik devices. Wifi wave2 does not do great out the box without some configuration and trial and error first. 😊

[@black_ierax]

A video going into detail for LTE, cell locking, and carrier aggregation. In a water bottling facility in Mount Athos, I am facing issues with my mobile operator. The cell tower that is located above Daphne is around 300m from the 4g router, and has power saving features enabled on high frequency bands, causing the router to drop connection to the cell tower. The router then establishes connection at cell towers located in Ierisos that is located around 36 ΚΜ, or at Sarti that is around 25km away, and located on the left of the dish. I am using a RBLHGR&R11e-LTE and waiting for a LHG LTE18 kit to arrive soon.

[@SavroRus]

thank you for clear explanation 🙏

[@user-fs4cx2uk4r]

Great video!!

[@salembaabbad8783]

Thank you sir I really enjoyed the video,I hope you made a videos for network topology examples 😊

[@agentbayabas]

can you create an details like that on how port forwarding works i want like that with visualization

[@anakinskywalker8624]

Thank you for this video topic :)

[@happy_dev]

uPNP part is missing in the summary as one of the options for how to make port forwarding. for the next video, I would show ipv6 with examples - we don't need nat but at the same time how don't open any home device into the internet, etc. another topic - wifi k/v/r - what every letter means and demos with facetime/voip calls during transitions between APs

[@mikrotik]

Not planning to do IPv6 videos at the time, but more wifi videos can be expected.

[@happy_dev]

@@mikrotik btw, any news about 160mhz and wifi 6e devices? And more 2.5gb/s ports, please!

[@user-ic2fo5rg2l]

Дуже дякую за такі гарні відео 😉😊

[@mnsi_darryl]

Solid intro on how NAT work, perhaps you can expand on NAT forwarding rules in RouterOS since you touched on the port knocking topic :)

[@mikrotik]

For sure, more videos on NAT are coming.

[@phil2768]

Thank you!

[@chaseendicott]

I would like to see more info about how Endpoint Independent NAT can help in a carrier grade NAT situation for ISP's that want to help open things up for customers so things aren't double NAT'ed. Setup and the benefits being highlighted would be helpful!

[@SoranEngineer]

great video thank you so much for explain

[@renekuhl7934]

Good Video.. Kepp it up Guys!

[@jiucaibox]

This video is so magnificent, I hope it can be translate to various languages.

[@mikkio5371]

Port address translation. The last two is what I don't know about ( harping & carrier ) . Druvis is back !! Being a while .

[@chechitogmail]

a clarification on NAT action=same and the option not-by-dst also, will be nice thank you, good video

[@mikkio5371]

Network trip was doing some great vidoe on firewall though too

[@chadtaylor1148]

I really enjoy the deeper videos where they deep dive into a topic, explain things, programming examples etc. Dont get me wrong I don't want the fun ones to go away but I would love a weekly series where we could expect to see a technical video every Tuesday or something like that.

[@Grmreeper100]

Thank you for the greate work

[@nicolaperotto1933]

The music is disturbing and confusing: some people here has to concentrare to understand what you say. The video is very well done, interesting and informative. Thanks

[@criticalmoorhen]

Video idea - CAKE and queue trees. There is also lack of documentation from your side on Cake, so I guess video would do it. Personally I expect you to show off how to setup up CAKE with proper parameters and set up queue tree, all for home/homelab users. I would like to see general recommendations on what kind of queues you might recommend, how to prioritize primary network and give "leftover" traffic to guest network or seedbox. Also - great video!

[@criticalmoorhen]

Another idea - how to properly set up hairpin NAT. It's one of those tricky areas to set up correctly and no "right" answer in forums too. :)

[@mikrotik]

We have a video about that kzbin.info/www/bejne/Z3qYd6ytjpuiprMsi=YvZBr2ygOkkPilp0

[@frankh.4420]

Thank you for that informative video. What about ipv6 fundamentials and subnetting?

[@jeytis72]

I'd like to see more videos about routing tables, routing rules, and firewall mangle marking. Thanks

[@kiranrajr]

Hi Team, The Video was amazing and very helpful for us. Can you make a video explaining CG NAT in MikroTik?

[@mikrotik]

For sure, probably after the holidays.

[@kiranrajr]

@@mikrotik Thank You 🙏🏻

[@pavelsmarhels8868]

It would be great to hear something about (diff/incr) config backup of bunch of mikrotiks. With products like rancid + git.

[@pmcmar]

Cool video. Maybe you could add the OSI model layer's namely the transport layer.. but it could get confusing 😅

[@user-pn4qz7dg2l]

RouterOS Firewall Mangle is fantastic. Please create new videos about different usages of Mangles and firewall rules like blocking Ads, doubling internet speed by using two ISPs, or even connecting to a website using a specific VPN interface. I also need to know how to monitor and debug the routing rules, connections, interfaces, and packets. Thank you for the great videos.

[@tlturner3]

Great video. It would be be to explain a common misconception to those new to routing and that confusing source NAT with static NAT and destination NAT dynamic NAT.

[@mikrotik]

Ok, we will do more RouterOS specific NAT videos!

[@gregmc3957]

Good video. Can you do a video on MSTP where vlans or redundant links between devices occur.

[@rusnyasosat]

Nice

[@aligenawi]

grate work , if you lower or remove the music during the talking it will make it easy to concentrate and follow up the topic .

[@examen1996]

Always loved mikrotik but never had one, really looking at a rb5009 , a device that i already recomended to a friend who bought it and is extremely happy with it. One great video ideea would be a entry 10gb home network for home labs, mikrotik(switch, router) equipment only. While I love openwrt, i cant help but wishing the quality of mikrotik hardware for my network . Regards

[@hristobarbolov5953]

An idea for a video - IPv6 and how to configure it

[@jfernandez76]

For a next topic, please, consider talking about cross-vlan mDNS.

[@nday345]

Thank you for the video! Tell us how SNAT works for protocols other than TCP and UDP, for example ICMP, GRE, IPIP, etc. How does a router keep track of connections when several hosts on the local network behind a NAT send ICMP requests to the same host on the Internet? How does he understand which host on the local network to return the ICMP reply to?

[@mikrotik]

Valid questions, there will be something short on ICMP and NAT.

[@MohammedBizzan]

Hey Mikrotik, will we get an Apple Silicion native winbox app?

[@mikrotik]

Eventually ;)

[@cruronet]

Hello i have a issue i have a server on my house port xxxx but when i turn of the server i pop up the router UI.... how do i prevent that happening

[@HarishSharmaDelhi]

I am small hotel owner and I would love to see a video that will explain how hotspot and usermanager work on RouterOS 7

[@tannoy]

Great video. Would be good to add how to set this up on RouterOs. Thanks.

[@mikrotik]

Will do!

[@user-wy2ys7eo8j]

chateau 5G ax update 7.13 后，找不到wlan1 wlan2 怎么解决？

[@dummydummydummy7568]

Hello, Very interesting video but could you please make other videos that delve deeper into the types of nat he showed? Thank you

[@mikrotik]

Absolutely! There will be demonstrations in RouterOS.

[@dummydummydummy7568]

Thank you@@mikrotik

[@userbanned4419]

ну на вас давно подписан, по этому нашел)

[@MartinEscudero]

HEY! When will routers have harpin nat activated by default and a DDNS integrated client for no-ip or other providers? Thanks

[@mikrotik]

Only a small percentage of customers will use Hairpin NAT, so there is no need to do the extra configuration for everyone. DDNS is integrated and available for everyone, just enable it in the IP Cloud section.

[@matejsojka6683]

make another video and show how to configure those nats explained here on mikrotik routers.

[@mikrotik]

There will be videos on all of them. We have already covered port-forwarding and Hairpin NAT in the past, however.

[@zanydaproduction]

Спасибо. Если добавите русские субтитры будет вообще фантастически❤. Mikrotik 👍🤟

[@zanydaproduction]

Хотя если смотреть через Яндекс браузер с переводом нейросети на РУССКИЙ то воОбще Агонь. 😀

[@Graham_Rule]

Great content. Terrible background 'music' made it difficult to concentrate on the words though.

[@apruszko]

Dear Dru, please create some video about iot mqtt with SSL and safe configuration (now: mqtt credentials in config are in plain text, reading this config, an intruder can break our mqtt broker, please see that certificates and keys are no stored in config, I mean "/export teres" does not show critical information). Thanks for previous video - those helps me buy many mikrotik hardwares 😊

[@mikrotik]

Like with other sensitive data on your router - the key is to use strong user passwords and not hand them out to anyone you don't trust.

[@meddle999]

IPv6 security topics please

[@emanuelcoc]

Muito bom

[@MateusProvesi]

Please talk about IPv6.

[@phcsmile]

How to use Mikrotik NAT or another. Trick. To avoid starlink detect internet sharing and stop throttle and tarping connection - bandwidth

[@cruelyamagaming7096]

When 5G sim router launching in india..?

[@yingpan6436]

hello miktorik, how to nat dstnat range port to range ip on mikrotik router ?

[@mikrotik]

We will cover dstnat in more detail :)

[@rihardsbimanis8390]

Why i cant port forward with BITE mobile network? Mikrotik LTE device shows private address, so maybe they are using NAT and blocking port 80?

[@mikrotik]

Mobile operators usually use CG NAT and other techniques, so for port-forwarding to work they would have to configure it at their end.

[@user-km4tt4ok8t]

Rihards, did you buy from BITE static public IP address?

[@ssimeonovbg]

More info about CGnat please

[@mikrotik]

Sure, after the holidays.

[@sebastiankutter3630]

I have an idea for a video series: Let's create our own ISP with MikroTik, including CGNAT, PPPoE, and so on.

[@mikrotik]

Depends on the region in the world. PPPoE is not used around here. I guess common ISP setups in Latvia would not be possible in your region.

[@sebastiankutter3630]

@@mikrotik In Germany you usually login to your isp with pppoe

[@mikrotik]

It's very sad, I'm sorry

[@sebastiankutter3630]

@@mikrotik How does it work in Latvia?

[@nelsonlim5189]

please do a CGNAT video please

[@mikrotik]

Will do.

[@user-vy4sf5fl3n]

make bgp video settings on v7 mikrotik

[@mikrotik]

In the plans already :)

[@next3138]

pls fix a problem ipv6 dhcp bad server duid 6660, ignore it

[@next3138]

SUP-137795

[@sabitzubairzayn6945]

Make a proper video about CGNAT if possible.

[@mikrotik]

Will do!

[@user-pz3tq1wj1z]

ros The download speed is so slow

[@notDacian]

The background music is way to loud!

[@userbanned4419]

основные вопросы: по видео всё понятно, лучше туториалы делайте как настраивать оборудование конечным клиентам, тк ваше оборудование с среднем сигменте для конечного пользователя.

[@QueeeeenZ]

You are pronouncing the word ”allow” wrongly. The emphasis is on the last syllable.

[@husseinadil6290]

The music has ruined the benefit of this video. Please make the background music calm and volume it down as much as possible. We are here to gain knowledge from you. Music is our last concern.

[@mikrotik]

We will try to do better.

[@davidz1264]

What is NAT? It‘s EVIL 🙈

[@wisperinternetinalambrico8590]

el nat deberia desaparecer para eso está ipv6

[@kiharamuchangi4228]

Bridging Video