Mikro Manager
en

CGNAT for MikroTik RouterOS

CGNAT maps many private clients onto a few public addresses by splitting each address's source-port space between them. Mikro Manager builds that layout from the parameters you actually care about, and shows you every rule it intends to write.

How the layout works

The private space is tiled into consecutive blocks the size of the public prefix. Each block is netmapped 1:1 onto the whole prefix on its own source-port range, so several blocks share every public address, separated by ports. Dispatch is a two-level jump — srcnat into a per-/24 chain, then into a per-block chain — so rule evaluation stays fast however many blocks there are.

Declarative, and idempotent

Every rule carries a structured comment encoding the entire pool. On connect the app reads the live rules and rebuilds the pools from those comments, then diffs what you want against what is there. The router is the source of truth, not a file on your Mac — and rules without a valid comment of ours are never touched.

Deterministic lookups, no flow logs

Because netmap is arithmetic rather than a lease table, a public address and source port resolve to exactly one private client — and back — with nothing recorded in advance. That is what an abuse report actually needs answering.

CGNAT generator for MikroTik RouterOS The pool is worked out in your browser. Nothing you type is sent anywhere — there is no server to send it to. Read more →
/ip firewall nat
add chain=srcnat action=jump jump-target=cgnat-10.64add chain=cgnat-10.64-b3 action=netmap \    to-addresses=200.2.3.0/27 to-ports=3072-4095 \    comment="mikro:v1;pool=cgnat;blk=3;cpi=256"
Plan
  • 2 create
  • 67 update
  • 66 delete

You review the plan before anything is written.

The life of a pool

A pool you can still change a year later

Most CGNAT setups are written once and then edited by hand, rule by rule, for the rest of their life. Here the pool stays a thing you can open, change and re-apply — because the router itself is where the design is kept.

  1. Design it

    Name it, set the private start and the public prefix, and choose how many ports each client gets. The blocks, port slices and rule count are worked out as you type. Nothing is on the router yet — the badge says Draft.

    Design it

  2. Read the plan

    Every rule it intends to write, in full: a /27 split 32 ways is 133 of them. Apply is the only thing that writes, and it reports each rule as it goes.

    Read the plan

  3. It becomes a pool, not a pile of rules

    Applied, it turns Live and reports what it owns on the router. The design lives in the rule comments, so the app rebuilds the pool from the router every time it connects.

    It becomes a pool, not a pile of rules

  4. Change it a year later

    Halve the clients per address and switch on Fasttrack, then review: two rules added, sixty-seven changed, sixty-six removed. Only the difference is written.

    Change it a year later

  5. Answer the abuse report

    A public address and a source port resolve to the client behind them — pool, block and port slice — by arithmetic, with no flow logs to keep.

    Answer the abuse report

Questions

Is this a CGNAT calculator or does it configure the router?
Both. It works out the blocks, the ports each client gets and the rule count as you type — that is the calculator — and then writes the netmap rules over the REST API, or hands you the script if you would rather paste it yourself.
Can I use this on a router that already has CGNAT rules?
Yes. The app only manages rules carrying its own structured comment; anything you wrote by hand is read but never modified or deleted.
How many clients can share one public address?
Any power of two from 1 to 1024. That figure sets how the source-port window is divided, so more clients per address means a narrower port range each.
Can it generate the RouterOS CGNAT configuration as a script?
Yes. Any pool exports as an .rsc file of the same tagged commands the app would send, for /import, a change ticket, or a router you only reach over a console.
What if I would rather apply the rules myself?
Export the pool as a RouterOS script and paste it into a terminal. The generated commands are the same ones the app would send.
Does it log which client used which port?
No, and it does not need to. The mapping is computed from the pool's parameters, so lookups work retroactively without any logging having been switched on.

Get Mikro Manager

Distributed through the Mac App Store — sandboxed, signed, and updated automatically.

Coming soon to the Mac App Store.

Requires macOS 14 or later, and a RouterOS v7 device with the REST API enabled.