Designing a Mikrotik CGNAT Solution that Scales#

Matthew Enger (Leaptel)

• Why: CGNAT at small/mid-ISP scale is a recurring pain point — statefulness, redundancy, and lawful-enforcement logging requirements all at once — and this is a from-the-field design others can replicate on a budget, distilled from commercial-solution experience.
• What: A step-by-step redundant, scalable CGNAT solution built from Mikrotik hardware, informed by what the author learned from commercial CGNAT deployments in Leaptel's main POPs, while meeting law-enforcement (logging/accountability) requirements (from abstract only).
• How: The abstract does not detail the mechanism (stateful NAT distribution, redundancy model, logging pipeline), so the design specifics are in the talk.
• Where applicable: Small-to-medium ISPs; explicitly scale- and budget-constrained, and Mikrotik-specific — not a technique for large operators, but directly copyable for its target audience.