Recipe: fixed public IP addresses | MikroTik Configurator

Goal: your ISP hands you a block of fixed public addresses; you put the WAN on it and give a server one of those addresses, with NAT or without.

What you need

The block in CIDR notation, for example 203.0.113.8/29, and which address in it is yours.
The ISP's gateway address and the DNS servers that come with the line.
The answer to one question: does the block sit on the same subnet as your WAN address, or does the ISP route the block towards your WAN address? That difference decides the rest of this recipe. If it is not in your paperwork, ask.
A modem in bridge mode. A block of fixed addresses does not work behind a modem that is still routing.

Mind the arithmetic: a /29 holds eight addresses, of which the first is the network and the last is broadcast. Six remain, and one of those is usually the ISP's gateway. So you keep five.

Step 1: the uplink

Pick your role (Home router or Office router with VLANs) and go to WAN / internet.
Set the uplink type to Static IP address.
IP address/prefix: your address with the prefix of the block, so 203.0.113.10/29 and not /32. With a /32 the router does not see the gateway as a neighbour and no route comes up.
Gateway: the ISP's address, for instance 203.0.113.9.
ISP DNS: fill in the servers from your line details. A static uplink has no DHCP to carry DNS along, which is why the "Use ISP DNS" toggle is not shown here. This field is used once you choose the ISP's DNS in the DNS section; pick your own resolver there and it does nothing.
Gateway check is set to ping. If your ISP blocks ping to the gateway, set it to arp, otherwise your route is marked dead while the line is perfectly fine.

Step 2: NAT or no NAT

In Firewall & NAT there is the choice NAT to the internet:

Masquerade — the default. Fine, but meant for an address that can change; the router looks up the source address per packet.
src-nat to a fixed address — more efficient with a static WAN address. Enter an address from your own block, not the gateway's.
No NAT — for a router where everything behind it has a public address.

Step 3a: the server behind NAT

The simplest route: the server keeps a private address and you add a port forward. In the Firewall section, under Port forwarding: protocol, external port, internal address, internal port. Turn on Hairpin NAT if you also want to reach the server from your own network through the public address.

A port forward from this tool matches on the WAN interface list, not on one particular destination address. So you cannot build a forward here that applies only to the second address out of your block. If you have several servers that all want port 443, that is the reason to give a server its own public address instead of a forward.

Step 3b: the server with its own public address

If your ISP routes the block towards your WAN address, you can use those addresses inside:

In VLANs, make a VLAN for your servers, say 50.
Set the Router address to the first usable address of the routed block, for example 198.51.100.1/29.
Switch DHCP off for that VLAN and give the server its address by hand. You do not want to hand public addresses out.
In the port assignment, set the port the server sits on to access with that VLAN.
Back in Firewall, under Custom filter rules, add what may come in: chain forward, action accept, protocol tcp, dst. port 443, destination address the server's address. That rule lands before the closing rule that drops everything from WAN.

This tool's masquerade rule applies to everything leaving through WAN, and there is no field to exempt one subnet. Connections from outside work fine, but connections the server starts itself leave under the router's WAN address. For a mail server, or anything else where the source address counts, choose No NAT, or adjust the NAT rule on the device yourself after pasting.

Step 4: testing

/ip address print — is your address on the right interface, with the right prefix?
/ip route print — is there a default route through your gateway, and is it not marked unreachable?
/ping 203.0.113.9 to the gateway, then /ping 1.1.1.1, then a name to test DNS.
From outside: reach the server's public address. Not from your own network, because then you are testing hairpin and not the forward.
/ip firewall filter print stats — is the rule you added counting, or is the traffic landing in the closing drop?

Where it goes wrong

The wrong prefix. The router's address takes the prefix of the block, not /32 and not /24.
Double NAT. With the modem still in router mode, your public block never reaches your router.
No DNS. A static uplink gets nothing automatically. Fill in the ISP's DNS, or pick a resolver in the DNS section.
The gateway outside the subnet. Then there is no route to the gateway itself and nothing works.
A WAN MTU below 1500. Leave Clamp TCP MSS on, or some websites will hang while everything else is fine.
Services on the router itself. Those do not belong under port forwarding but under Services on the router itself reachable from the internet. Do not open anything there that you could reach over WireGuard instead.