1:1 NAT in OpenWrt

Installing and Using OpenWrt Network and Wireless Configuration
1

I' using a AVM Fritzbox as internet router, with a "main" network (192.168.178.0/24) and a guest network (192.168.179.0/24). There is a printer connected to the guest network, that I would like to use from the main network, too.

I read in another forum, that this can be done by installing a router with a 1:1 NAT that is connected to both networks. It has an IP in the main network (e.g. 192.168.178.100) and forwards all traffic directed to it to a specified addess on the other network (e.g. the printer on 192.168.179.100).
So I installed OpenWRT (19.07.6) on an Ubiquity ER-X router and tried to setup a 1:1 port forwarding. After hours of unsuccessful attempts, I hope to find somebody here to help.

I successfully did 1:1 port forwarding on a pfSense, where this is easy to setup. There I created an alias IP on one interface, a 1:1 NAT rule to connect it to the destination IP on another interface and setup afirewall rule to allow traffic. But on OpenWRT this doesn't work.

Does anybody know, how to setup OpenWRT to get a working 1:1 NAT?

2

Set up a pair of DNAT and SNAT rules like these:
https://openwrt.org/docs/guide-user/network/wan/multiple_public_ips#configuration_examples

Also enable masquerading on the guest zone if this is not your main router in that network.

3

If there is SNAT in place, what is the reason for masquerade?

1 Like
4

Actually, the SNAT rule appears to be unnecessary if connections are initiated exclusively from the main to the guest network.

1 Like
5

Thank you very much for your help. However, I was not successful, even after trying hours (again) I couldn't get it to work.

6

Please run the following commands (copy-paste the whole block) and paste the output here, using the "Preformatted text </> " button:
grafik
Remember to redact passwords, MAC addresses and any public IP addresses you may have

ubus call system board; \
uci export network; uci export firewall; \
head -n -0 /etc/firewall.user; \
iptables-save -c; \
ip -4 addr ; ip -4 ro li tab all ; ip -4 ru
1 Like