Main problem, if i forward a port to internal ip, lets say 213.213.213.213:25 → 10.0.0.1:25, i cannot access it using FQDN from internal network.
In current example port 25 is forwarded, so if i use mail.blabla.com as SMTP server, then from internal network i get timeout and mail cannot be sent, from outside everything works ok.
I know there is workaround, to create record in local DNS to point to 10.0.0.1, but this only partialy resolves the problem.
Because if a user goes somwhere outside local network, with his notebook, and after a while comes back, he has record in his notebook DNS cache that mail.blabla.com is at 213.213.213.213 and he cannot send mail from local network anymore, until dns cache is flushed.
And equal situation is for everything else, if i forward port 80, from outside webpage is accessible, but from inside is not.
RB433, v3.28
Port forwarding done like this :
/ip firewall nat add chain=dstnat dst-address=69.69.69.69 protocol=tcp dst-port=5900
action=dst-nat to-addresses=192.168.1.101 to-ports=5900
Tried also other method found in forums, using netmap, the same result.
In linux if i do port forwarding in iptables then there is no such problems, also in any “cheapy” router like D-Links, Linksys etc, there’s also no such problems with port forwarding.
there MUST be such problem. because server sends response directly to the client, not via router, so router cannot ‘de-NAT’ those addresses. client sends packets to 213.213.213.213, receives an answers from 10.0.0.1 and drops them =)
the solutions: =)
split DNS (resolves FQDN to external address for external users, and to internal - for internal ones);
add src-nat rule, so router will masquerade clients (server will see only router’s ip in incoming packets);
move server out of user’s subnet, so that server replies via router, not directly).
DNS is split allready, but as i allready writed, if a user with notebook goes to some other place checks e-mail an then returns, in his notebook local dns cache there is still record that mail.blahblah.com was at 213.213.213.213 and does not perform lookup against internal dns server. only when a DNS cache is flushed (or expires, usualy after 24h) they get correct ip from internal server.
Interesting then how linux iptables works without a problem in the same setup?
Maybe there is some ip filter rules to overcome behavior like this.
as i understand, when dst-nat’ing mikrotik rewrites destination address (public ip) to internal ip and sends it from own internal interface to 10.0.0.1 and when receives answer from server changes internal ip address to public IP and sends to …
This sh*t with mikrotik is cousing me too much trouble, i think Mikrotik 433AH will have to go …
How does all other routers then deal with this problem?
It comes in as 69.69.69.69, and dst-natted to 192.168.1.101. But that is not enough. It must go out the same way. The srcnat insures that the responses go back out as 69.69.69.69. Otherwise, they will show as your default IP on that interface if you use a masquerade here too. That isn’t 69.69.69.69, is it?
i think MT lacks some internal inteligence to deal with this problem.
As i allready stated linux iptables, bsd pf does not have such problems including many of linux/unix firewall/router implementations like - m0n0wall, PfSense, Endian, IPCOP, Smoothwall etc etc.. Also any cheapest router can handle port forwarding corectly (if someone dont like term corectly, then i should say - the way i want and think it should work ). i mention linux, because routerOS is built on/from linux.
Please notice the wording on my response. I did not say this might work, or this could work, or something like that. This works. It is working. I just used it. Http, email, ftp, etc, all from the internal net using the public domain name.
Since mrz brought it up, I do NOT use “action=masquerade” for the default nat when assigning multiple ips to an interface. I always use “action=src-nat” only. Masquerade with multiple ips leaves too much to chance for me. I have found it does not always choose the ip you expect.
Like i already mention that i masqueraded Local to Local address so people on my LAN 192.168.88.1/24 can brows and send mail. I set up mail server and on the PC runing the main server i can send and receive the mail but when trying to send and receive on my other PC on the same LAN i get in Outlook Express Err: Can not Connect to POP server???
What i have done in my Firewall>NAT config is this:
For every subnet in firewall ( local to local masqueraded ) i also had configuration set for “Outgoing Interface” to my PPPoE connection ( my WAN, internet ISP Dsl line ).
SO I REMOVE IT FROM MY 192.168.88.1/24.
AND IT WORKED.
). i mention linux, because routerOS is built on/from linux.