Skip to content

P01-T05 - NAT

Objective

Enable internet egress for internal lab networks through HQ-CHR01 using the exact masquerade rule defined in the source deployment flow.

Validated lab status

Validated against the live lab on Friday, July 17, 2026:

  • NAT Internet exists as a srcnat masquerade rule using out-interface-list=WAN
  • HQ-CHR01 reached 1.1.1.1 and cloudflare.com
  • HQ-DC01 also reached the internet through the router after the baseline was applied

Inputs

Key Value
Router HQ-CHR01
NAT method srcnat masquerade
WAN selector out-interface-list=WAN

Target State

Property Value
NAT rule count At least one approved internet NAT rule
Rule comment NAT Internet

Prechecks

  • Complete P01-T04.
  • Confirm interface list WAN contains ether1.
  • Confirm the WAN route is already present from P01-T02.

Execution

Create the NAT rule in a way that is idempotent and order-safe:

:local NatComment "NAT Internet"
:local NatRule [/ip firewall nat find where comment=$NatComment]

:if ([:len $NatRule] = 0) do={
    /ip firewall nat add \
        chain=srcnat \
        action=masquerade \
        out-interface-list=WAN \
        comment=$NatComment
    :set NatRule [/ip firewall nat find where comment=$NatComment]
}

:foreach RuleId in=$NatRule do={
    /ip firewall nat move $RuleId 0
}

If NatRule matches more than one entry, :foreach still works. A direct move $NatRule 0 can fail with invalid value for argument numbers.

Verify:

/ip firewall nat print detail

Validation

  • NAT table contains a srcnat masquerade rule using out-interface-list=WAN.
  • The NAT Internet rule is positioned before later ad hoc srcnat rules.
  • Internal lab networks can egress to the internet once forward rules are in place.
  • Later downstream validation from Windows workloads confirms server and client egress through this same NAT path.

Evidence

  • Output of /ip firewall nat print
  • Output of /ping 1.1.1.1
  • Output of /ping cloudflare.com

Rollback

  • Remove only the incorrect NAT rule if duplicated or malformed.