The two services that make a LAN usable: handing out addresses automatically, and sharing one public IP across the whole office. DHCP pools, relay, PAT overload, and static NAT for port forwarding — with the verify commands that make troubleshooting quick.
Two services turn a bare router into a working internet gateway. DHCP hands every device an IP, gateway, and DNS server automatically — no one configures a laptop by hand. NAT translates the many private addresses behind you into the one (or few) public addresses your ISP gave you, so the whole office shares a single WAN IP.
In practice you'll use one flavour of NAT constantly — PAT, "NAT overload", which multiplexes an entire LAN onto one public IP by tracking port numbers — and occasionally its inverse, static NAT, to publish an internal server to the internet (port forwarding). This tutorial builds all of it on an IOS router, then maps it to the MikroTik equivalents. If you set up masquerade and dst-nat on RouterOS, you already know the shapes.
01
A Cisco router makes a perfectly good DHCP server for a small site. Exclude the static addresses first, then define a pool — network, gateway, DNS, lease time.
# 1. Reserve the addresses DHCP must NOT hand out (gateway, servers, printers) R1(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.20 # 2. Define the pool R1(config)# ip dhcp pool LAN R1(dhcp-config)# network 192.168.1.0 255.255.255.0 R1(dhcp-config)# default-router 192.168.1.1 R1(dhcp-config)# dns-server 1.1.1.1 8.8.8.8 R1(dhcp-config)# domain-name noctis.lan R1(dhcp-config)# lease 0 12 0 # 0 days, 12 hours, 0 minutes R1(dhcp-config)# end
The network statement makes the router willing to lease every address in that subnet — including your gateway .1 and any static servers — unless you excluded them. If you skip ip dhcp excluded-address, DHCP will happily hand a client the same IP as your router or a printer, and you'll chase a duplicate-address ghost for an hour. Exclude the static block first, every time.
R1# show ip dhcp binding IP address Client-ID/Hardware Lease expiration Type 192.168.1.21 0100.1a2b.3c4d.5e Jul 12 2026 09:14 PM Automatic 192.168.1.22 0100.1a2b.3c4d.6f Jul 12 2026 09:15 PM Automatic R1# show ip dhcp pool Pool LAN : Total addresses : 254 Leased addresses : 2 Excluded addresses : 20 # Conflicts (an address DHCP found already in use) show up here: R1# show ip dhcp conflict
02
DHCP uses broadcasts, and routers don't forward broadcasts. So a client in VLAN 20 can't reach a DHCP server in VLAN 10 — unless the gateway relays the request. That's ip helper-address.
# On the interface/SVI that faces the CLIENTS (their default gateway), # point at the DHCP server's unicast address: R1(config)# interface vlan 20 R1(config-if)# ip helper-address 192.168.10.5 R1(config-if)# end # The router now converts the client's DHCP broadcast into a unicast to # 192.168.10.5, stamping the source subnet so the server picks the right pool.
The most common relay mistake is putting ip helper-address on the wrong interface. It belongs on the interface closest to the clients — the one that receives their broadcast — pointing at the server. One helper per client subnet. And ip helper-address relays more than DHCP by default (TFTP, DNS, NTP and a few others); if you only want DHCP, prune the rest with no ip forward-protocol udp <port>.
03
NAT confuses people because of four terms that sound alike. Nail them once and every NAT command reads plainly. Inside/outside is about which side of the router; local/global is about which address — private or public.
| Term | Means |
|---|---|
| inside local | The private IP a host really has (192.168.1.10). |
| inside global | The public IP the world sees that host as (203.0.113.7). |
| outside global | A public IP out on the internet (e.g. a web server you visit). |
| inside interface | The router leg facing your LAN — marked ip nat inside. |
| outside interface | The router leg facing the WAN — marked ip nat outside. |
Every NAT config starts the same way: tell the router which interface is inside and which is outside. Nothing translates until you do.
R1(config)# interface GigabitEthernet0/1 R1(config-if)# ip nat inside # LAN side R1(config-if)# exit R1(config)# interface GigabitEthernet0/0 R1(config-if)# ip nat outside # WAN side R1(config-if)# end
04
This is the NAT you'll configure 95% of the time. PAT (NAT overload) maps every inside host to the single public IP on your WAN interface, keeping flows apart by port number. It's exactly what your home router does.
# 1. An access-list describing WHO is allowed to be translated (the LAN) R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255 # (0.0.0.255 is the wildcard mask — the inverse of 255.255.255.0) # 2. Translate that list, overloaded onto the outside interface's IP R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload R1(config)# end # "overload" is the keyword that turns NAT into PAT (port multiplexing). # Every LAN host now reaches the internet as the WAN interface's public IP.
NAT translates addresses; it does not route packets. If the router can't already reach the internet — a default route ip route 0.0.0.0 0.0.0.0 <next-hop> out the outside interface — then translated traffic still goes nowhere. Likewise, if you forget ip nat inside/outside on the interfaces, the ip nat inside source rule matches nothing and hosts get no translation at all. Interfaces marked, route present, then NAT.
05
PAT lets inside hosts reach out. To let the outside reach IN — publish a web server, a mail server, a camera NVR — you need a static mapping: a fixed public IP:port to a fixed private IP:port.
# Publish internal 192.168.1.10:443 as the WAN IP's port 443 R1(config)# ip nat inside source static tcp 192.168.1.10 443 interface GigabitEthernet0/0 443 # Or, if you have a spare dedicated public IP, map it whole: R1(config)# ip nat inside source static 192.168.1.10 203.0.113.8 R1(config)# end # Remember the firewall/ACL still has to PERMIT the inbound traffic — # NAT opens the address translation, not the door.
Prefer the tcp <ip> <port> interface … <port> form over mapping a whole address whenever you can. Exposing a single service port (443) is a far smaller attack surface than publishing an entire host to the internet. And always pair a static NAT with an inbound ACL that permits only that port from the sources that need it — a forwarded RDP or camera port open to the whole internet is one of the most-scanned holes there is.
06
Two commands answer almost every NAT question: what's currently translated, and are translations even happening.
R1# show ip nat translations Pro Inside global Inside local Outside local Outside global tcp 203.0.113.7:1044 192.168.1.10:1044 93.184.216.34:443 93.184.216.34:443 tcp 203.0.113.7:443 192.168.1.10:443 --- --- # Top line: a host reaching out (PAT). Bottom: your static port-forward. R1# show ip nat statistics Total active translations: 2 (1 static, 1 dynamic; 1 extended) Outside interfaces: GigabitEthernet0/0 Inside interfaces: GigabitEthernet0/1 Hits: 1523 Misses: 0 # Watch translations happen live (turn it OFF the moment you're done): R1# debug ip nat R1# undebug all # Clear the dynamic table to start fresh (static entries stay): R1# clear ip nat translation *
An empty dynamic table when hosts should be online almost always means one of three things: the interfaces aren't marked ip nat inside/outside; the access-list doesn't match the source subnet (check the wildcard mask — 0.0.0.255, not 255.255.255.0); or there's no route to the outside. Static entries always show even with zero traffic, so if your static forward is listed but no dynamic entries appear, suspect the ACL or the inside/outside marking.
07
If you built masquerade and dst-nat on RouterOS, Cisco NAT is the identical concept with different keywords. Here's the direct map.
| MikroTik / RouterOS | Cisco IOS |
|---|---|
| /ip pool + /ip dhcp-server | ip dhcp pool + ip dhcp excluded-address |
| dhcp-relay | ip helper-address |
| action=masquerade (srcnat) | ip nat inside source list … overload (PAT) |
| action=src-nat to-addresses=<pub> | ip nat inside source static <local> <global> |
| action=dst-nat (port forward) | ip nat inside source static tcp … interface … <port> |
| /ip firewall connection tracking | show ip nat translations |
On MikroTik, NAT is a firewall action — a rule in the srcnat/dstnat chain, evaluated with everything else. On Cisco, NAT is its own subsystem: you mark interfaces inside/outside and write ip nat rules separately from the ACL/firewall. Same result, different mental model. When we run mixed sites — a MikroTik edge and Cisco core, common in Crete SMBs — this table is what keeps the two straight in everyone's head.
Takeaways
network statement offers the whole subnet; ip dhcp excluded-address is the only thing stopping DHCP from leasing your gateway and servers out from under you.ip helper-address goes on the interface facing the clients, pointing at a central DHCP server. One per client subnet.ip nat command reads plainly after that.ip nat inside/outside means no translation, no matter how correct the rules are. Interfaces marked → route present → NAT rule.ip nat inside source list … interface … overload puts the whole office behind one public IP.show ip nat translations (what's mapped) and show ip nat statistics (is it happening) — an empty table points straight at interface marking, the ACL wildcard, or a missing route.NOCTIS configures DHCP, NAT, and secure port-forwarding on Cisco and MikroTik edges — with the firewall rules that keep published services safe — and documents every mapping so your team knows exactly what's exposed and why.
Book a Discovery Call →