I use Mikrotik RouterOS as the NAT router. Some hosts behind the router also have a direct connection to the Internet and these hosts have a default route to the ISP's gateway instead of RouterOS. I set up a OpenVPN server in tun mode on one of these hosts with public ip. The problem is that VPN clients cannot communicate with hosts that have a public IP because they have a default route to the ISP. I can put a static route on RouterOS but I have no control over my ISP's router. So packets sent to the VPN client are sent to WAN link instead of the VPN server. What options do I have?

private DHCP pool, gateway (RouterOS)

OpenVPN pool

  1. tap mode, a lot of overhead
  2. tun mode, VPN pool inside DHCP pool and OpenVPN server proxy-ARP for the VPN pool in the LAN
  3. tun mode, add a static route for OpenVPN pool on every host with a public IP. This does not scale well, too much work in a mixed environment
  4. IPv6. The problem is that a lot of Windows applications (for example VMware products) have poor support for IPv6. All hosts do have IPv6 connectivity but VPN clients might have a hard time getting IPv6.

I know I probably should put everything behind the firewall. I will do that after I get a Juniper SRX. I don't have enough public IPs for every host. And RouterOS/pfSense is not well suited for an environment with mixed public/private IPs. I have to admit this is a poor design to begin with, any migration path without breaking the bank? It's not production, just a bit complicated home network.

I appreciate your input.

Edit1 (Response to JelmerS's answer): This is doable but does not scale really well as I mentioned in OP. In the environment I have different flavors of BSD, Linux, Windows and standalone appliances without shell (e.g. printer, network monitoring devices, phone). I will try DHCP option 33 and option 121, not sure how well they are supported on different devices.

Edit2 (Response to Joseph Drane's answer): 1. Currently hosts with a public IP have a link to RouterOS LAN and another link to the ISP (bypass RouterOS)

  1. Is there any justification for doing static NAT? It seems unnecessary (heavy performance penalty)

  2. The firewall I am looking for can work well in transparent mode. DHCP/NAT can totally be done by another box. But most firewalls I have used don't support/work well in transparent mode and are difficult to troubleshoot (lack of visibility)

Edit3: RouterOS runs inside ESXi. There are some other guest OSes. The environment is mixed with physical/virtual hosts. I do have enough NIC interfaces on ESXi box. I want the flexibility to allow hosts to easily switch between public/private address.

closed as off-topic by Ron Maupin Apr 7 at 1:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.


Routes are always chosen in order of specificity. Say a host has a route to via router A and via router B. As soon as it wants to send a packet to, it will prefer router B over router A. A default route is the least specific route you can have. Any other route you add will be preferred over a default route. So the answer is simple: add a specific route to the VPN DHCP pool via the Mikrotik router. Don't forget to make the routes persistent, so they will survive a reboot. Asuming your DHCP pool is and your Mikrotik has IP and is connected on eth0, Here is the command for Windows:

route add -p MASK

For Linux, a persistant route is added by editing the /etc/sysconfig/network-scripts/route-eth0 file to define static routes for eth0 interface.


So, like you know already, hosts with public IP addresses assigned is not good. I'm referencing your comment about putting a firewall in front.

I would use your router, add another interface for a DMZ network. This DMZ network would use private ip addresses not public.

Then, inside your router, just NAT the public to that private IP address.

So current config: [internet]---->RouterOS----->Host w/ public IP

New config/setup: [Internet]--->RouterOS<--->NAT public IP <--to-->>Host w/ Private IP

So now you can just put in a route to the subnet/network which will be the DMZ subnet/network.

You can do some cool stuff with IP Tables in regards to having a "make-shift" firewall but I am not the guy to help with that. I'm a Cisco guy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.