Public IPs on Local Devices

[Zac123]

Hey all:

I'm planning to swap out an existing non-Meraki device with an MX95.  Some of the devices behind the existing firewall have public IPs.  The internal interface on the existing router has a public IP also, and that's how those devices get out to the internet.  So they still go through the firewall, but they aren't NATed.

I'm trying to figure out how to make this work.  I know that I can get Meraki support to enable a No NAT beta feature, but I'm hesitant to do so.  Lots of the MX features are in beta, but this one is so beta that support has to enable it.  That makes me nervous and not want to go that route.

Does anyone have an idea that doesn't involve the No NAT feature?

[Ryan_Miles · Accepted solution]

You don't need no nat feature. In the 1:1 NAT just enter the same IP in the Public and LAN boxes.

[Zac123]

Thanks for the reply.

I didn't think of that.  Have you done something like that before?  I just assumed that the dashboard wouldn't let me configure a 1:1 rule like that.

Edit:  I did some digging on this.  The dashboard let's me configure the same address for the public and private IP.  Also, I stumbled on a reddit post where someone did this.  My only issue now is that there isn't a way to filter traffic other than identify which source addresses are allowed.  For example, I can't filter out all traffic except a handful of TCP and/or UDP ports.  Would it be better to use the 1:Many NAT instead and forward the specific ports that communication is allowed on?  

[Ryan_Miles]

That is the recommended way and we have many customers using it.

[Ryan_Miles]

If you click the Allow more connections link you can enter lines for specific protocol, ports, and remote IPs to allow