Port Forwarding setup frusterations with Dynamic IP (Home)
If you installed RouterOS just now, and don't know where to start - ask here!

12 posts   •   Page 1 of 1
BackwardsCire
just joined
 
Posts: 17
Joined: Tue Jun 26, 2012 3:19 pm

Port Forwarding setup frusterations with Dynamic IP (Home)

by BackwardsCire » Wed Jun 27, 2012 8:45 pm

Port Forwarding setup frusterations with Dynamic IP (home service) on RB450G


I'm very new to MikroTik gear and having a heck of a time trying to get simple port forwarding working on my RB450G. I'm using this as my home router after getting sick of crappy home level gear failing and crashing on me (linksys, netgear, etc.). I'm upgrading from a Linksys WRT120N where port forwarding was as simple as going in and telling it which IP to forward to.

I've done a fair amount of searching and reading threads here as well as familiarzing myself with the MikroTik interface. Using WinBox, I've got the router up and running, changed the internal IP and DHCP to my prefered address space, setup custom DNS, NTP, and upgraded the system to the latest 5.18 code. As this is residential service, I have a DHCP (dynamic) IP from the Internet Provider.

All of this is working great and I've seen a fair speed increase over the Linksys in Internet and LAN traffic. Plus the thing doesn't feel so hot I could cook eggs either.

I have three systems that I want to forward services to:

- Windows RDP 3389 Internal IP 172.27.27.251
- Linux web server 22, 80, and 443 Internal IP 172.27.27.252
- Synology NAS 1194 and 1723 Internal IP 172.27.27.254


The internal IP of the router is 172.27.27.1


All of the examples that I could find through searching specify a static external IP to setup the port forwarding. In this case, I have a Dynamic IP and that won't work long term.

This is a fresh config on the RB as well, so I don't even see the DST-NAT chain in the Firewall screen under NAT. Trying to set it up asks for an external IP and won't accept an inferface name.

If I try to just setup a new port forward rule, I actually don't see the "to-address" field anywhere, just an "address list" field and not sure what to set for the action pull down.

My next thing will be to just try command line and paste in some modified commands from the Wiki, but I think that I'm just overlooking some obvious config steps.


I'm hoping that some of you most experienced gurus can pity a newb and spell out everything that needs to be done for port forwarding on a Dynamic IP to get this to work from a fresh config.


Thanks

User avatar
lordkappa
Frequent Visitor
Frequent Visitor
 
Posts: 68
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by lordkappa » Thu Jun 28, 2012 1:17 pm

I assume you've set up a master SRC-Nat rule to NAT all your privately addressed traffic over your outbound interface. Your issue is only that the examples used a specific external destination IP for the DST-Nat rule?

When you're setting up the specific DST-Nat rule, about halfway down the window, there's an "in-interface" match option. (See attached) If you change the highlighted options from my screenshot, you should be able to get it working for your specific setup.
Attachments
winbox2.jpg
winbox2.jpg (110.42 KiB) Viewed 30699 times
If my post has helped you, let me know by clicking the +Karma button. It only takes a second. :)

BackwardsCire
just joined
 
Posts: 17
Joined: Tue Jun 26, 2012 3:19 pm

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by BackwardsCire » Thu Jun 28, 2012 4:51 pm

Thanks for the reply. I ended up figuring it out last night before this topic was approved. The problem is that I was making the assumption that a dstnat chain needed to be setup on the IP>Firewall>NAT tab so that I could set the port forwarding with rules on the IP>Firewall>Filter tab. In reality, the port forwarding rules go directly on the NAT tab without having to setup an overall dstnat chain. So simple, yet I over looked it.

So in short, the problem existed between the chair and the keyboard. :?

For anyone who may be in the same boat with this, the solution is actually very easy for a dynamic IP.

Once you have your router setup at home passing packets, doing source NAT (should be in there by default, at least it was on my 450G), and handing out your preferred DHCP address, do the following:

a) Command Line

Select a terminal in Webfig or Winbox
Enter the following command with your ports and IPs:

Code: Select all
/ip firewal nat add chain=dstnat dst-port=<PORT> action=dns-nat protocol=<tcp/udp> to-address=<INTERNAL IP> in-interface=<NAME OF EXTERNAL INTERFACE>


If you have the NAT tab open, you'll see the new rule pop up.

Now I was trying to setup port forwarding on port 80, and using the example in the manual it does NOT specify an in-interface so it will forward ALL port 80 traffic from any interface to the specified IP. Not good since it will keep any other computer from browsing the web over port 80.

Key point for dynamic IP is to specify the in-interface (the name of which can be found on the interfaces menu. By default, my external interface is "ether1-gateway")

If you wanted to use the GUI:

1) Go to IP > Firewall and select the NAT tab.
2) add a new rule
3) find the boxes to enter the info contained in the command line setup above and lordkappa's graphics above


Whew. All that to figure out the problem was me. :)

Out of curiosity, if you're in the same boat and this helped you with your dynamic IP port forwarding setup, please post a reply. Maybe I'll post this into the Wiki if I find I wasn't alone.

RomelSan
newbie
 
Posts: 25
Joined: Fri Jul 06, 2012 1:53 am

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by RomelSan » Fri Jul 06, 2012 2:03 am

BackwardsCire! Thanks!
My settings works now! Trying for hours :p

and for remote administration via WinBox i used:
/ip firewall filter
add action=accept chain=input comment="WinBox Wan Administration" disabled=no \
dst-port=8291 protocol=tcp

It works, but now i am wondering.... How can you protect this port against brute force?

wirelessadweb
just joined
 
Posts: 3
Joined: Sat Dec 22, 2012 9:16 am

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by wirelessadweb » Mon Jan 07, 2013 11:41 am

Hi I am new to Mikrotik too and wasted Sunday trying to get basic port 80 forwarding to an internal address running. I have tried configuring from scratch and used a default config. Even tried two differnt versions of the OS

I am looking top use webfig and forward 80 to a camera on the inside. I have used the rule from the wiki and now the one here replacing the dst-address with the In-Interface as described here.

Also combinations of dst-nat or netmap on action.

I have set IP/Services/www to 81 and that is available in the default config if I disable the filters.
I can not get to 80 what ever I try. I have even tried changing the port on the camera to take it away from 80 - but nothing.

Do I need to add a filter?

RomelSan
newbie
 
Posts: 25
Joined: Fri Jul 06, 2012 1:53 am

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by RomelSan » Mon Jan 07, 2013 5:09 pm

Test it from outside your network... If you want to test this from inside too, then you must Hairpin NAT.

http://wiki.mikrotik.com/wiki/Hairpin_NAT

wirelessadweb
just joined
 
Posts: 3
Joined: Sat Dec 22, 2012 9:16 am

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by wirelessadweb » Mon Jan 07, 2013 5:46 pm

Thanks for the post - I am testing from the outside this should be so simple.

I have done this with other routers I am not that familliar with the Mikrotik but I have followed the instructions here to the letter working from a default config on a omnitik with OS 5.20 and a RB751u-2Hnd with 5.22.

I can get to webfig on port 81 if i disable the last filter in the default config.

gotsprings
Member Candidate
Member Candidate
 
Posts: 180
Joined: Mon May 14, 2012 9:30 pm

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by gotsprings » Mon Jan 07, 2013 8:56 pm

wirelessadweb wrote:Thanks for the post - I am testing from the outside this should be so simple.

I have done this with other routers I am not that familliar with the Mikrotik but I have followed the instructions here to the letter working from a default config on a omnitik with OS 5.20 and a RB751u-2Hnd with 5.22.

I can get to webfig on port 81 if i disable the last filter in the default config.

Some ISPs block incoming connections to port 80. Its to prevent you from hosting a webserver at home.

wirelessadweb
just joined
 
Posts: 3
Joined: Sat Dec 22, 2012 9:16 am

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by wirelessadweb » Tue Jan 08, 2013 10:33 am

I did not need the hairpin I needed a sanity check, so I plugged in a router I know the Ubiquity and the same result - that is when it clicked check the camera and bingo.

Thanks for all the responses I will ensure I test the test environment before I post again.

illuminet
just joined
 
Posts: 1
Joined: Mon May 19, 2014 4:50 am

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by illuminet » Mon May 19, 2014 4:55 am

i have tried to config shown but unfortunately it didnt work out. i have followed above steps..

my situation :
i have a server local ip address 192.168.2.3 port 9165
my public ip : 121.121.25.229

i've used dst nat.. followed every steps but it still cant get thru.. anyone can help me?

Trackboy
Member Candidate
Member Candidate
 
Posts: 157
Joined: Mon Oct 31, 2011 12:19 pm
Location: Hungary

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by Trackboy » Wed Oct 22, 2014 7:57 pm

Hello everybody! I have got a port forwarding problem. I did not want to strart a new thread. I have a server and there are 2 ports that i want to forwarding. The problem is that, the both port is not working at the same time.

Server ip address is: 10.10.10.2

10.10.10.2: 40000 ( torrent )
10.10.10.2: 28000 ( this is another one service )

If i disable the torrent port the second one is works.

gotsprings
Member Candidate
Member Candidate
 
Posts: 180
Joined: Mon May 14, 2012 9:30 pm

Re: Port Forwarding setup frusterations with Dynamic IP (Hom

by gotsprings » Sun Oct 26, 2014 3:52 pm

illuminet wrote:i have tried to config shown but unfortunately it didnt work out. i have followed above steps..

my situation :
i have a server local ip address 192.168.2.3 port 9165
my public ip : 121.121.25.229

i've used dst nat.. followed every steps but it still cant get thru.. anyone can help me?


Code: Select all
/ip firewall nat
add action=dst-nat chain=dstnat comment="my server" dst-address=\
    121.121.25.229 dst-port=9165 protocol=tcp to-addresses=192.168.2.3

12 posts   •   Page 1 of 1

Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 15 guests

It is currently Mon Nov 24, 2014 5:33 am