I have a lab setup like so in ESXi: Virtual MikroTik router ( Virtual Domain Controller ( Virtual Linux Server (

The host itself is connected to a LAN with IP address of The LAN has a physical MikroTik router.

Virtual MikroTik can access the Internet and LAN devices via physical MikroTik, but physical MikroTik can't see anything on the virtual network.

I would like to connect a physical device that will talk to Virtual Linux server from physical LAN through to virtual network.

How do I do that on MikroTik? Do I set up a dst-nat rule?

  • You probably want to trunk to the host, vs having an access port. – Ron Royston May 20 '16 at 20:45
  • To clarify: ESXi[3xVm's]<-PhyNic->PhyMikroTik<->WWW ? – Pieter May 20 '16 at 20:45
  • Please give details of your ESXi vswitch config. – Pieter May 20 '16 at 20:47

Here is how you accomplish a virtual MT instance acting as gateway for a bunch of VMs.

ESXi: Add 2 vSwitches. The first one is called "WAN" and you add the physical NIC to that switch.

The second is called "LAN" and has no physical interfaces.

Configure your virtual MT with 2 E1000 NICs, one connected to WAN and one to LAN. Boot the virtual MT and configure its interfaces. In the following example I will assume the MT interface "Ether1" is connected to the WAN and "Ether2" is in LAN.

Configure Ether1 with (or another open address). I assume the physical MT device acts as gateway for the network and has address Therefore your setup the default gateway on the virtual MT as

Next we configure Ether2 with IP:

You are now done configuring the virtual MT.

Now change the "Virtual Domain Controller" and "Virtual Linux Server" so their NICs are bound to the "LAN" vSwitch.

Last you add a static route on the physical MT: DST Address: Gateway: (or what ever open address you assigned Ether1 on the virtual MT)

That's it now you can reach the VM hosts and they can reach the internet.


You question does not address this, but i would like to save you the frustration in case you want to setup a DHCP server on Ether2. It will not work unless you change the "LAN" vSwitch to allow promiscuous mode. That can be done in the vSwitch config.

  • One thing to pay attention to is to ensure that when you are assigning the physical NICs to the WAN vswitch is that you don't take the physical NIC away from the ESXI. This can result in a loss in communication with the ESXI and an inability for data to flow. – Zack Scaringello Sep 1 '16 at 19:13
  • 1
    Agreed, if you only have one NIC just rename the current vSwitch "WAN", rather than start moving port groups. – MerlinTheMagic Sep 1 '16 at 20:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.