https://wiki.mikrotik.com/wiki/Manual:IP/Fasttrack Thanks Adahi, is this the reason of why I get not even half of my ISP's broadband speed? If this is the solution, how is it implemented? Shouldn't this be acivated by default? I permanently install and recomend Mikrotik routers, but many users are ...

Hi, My ISP provides 400Mbps Directly connected by cable to the gateway I get 400+Mbps speedtest Wired through the Mikrotik hAP ac I can't get that speed, max about 250Mbps (Gbps LAN card) WiFi I get max 150Mbps when connected to the 5G signal and doing a speedtest.net from my DELL E5470 notebook wit...

SOLVED!!
It was just a problem of another port, my NVR uses sdk port 6060 and media port 7070
No need of src-nat rule, special routes, no mangle, no netmap, etc.
You just need to have a vpn running and a dst-nat rule at the server router.
Thanks all for your help

Maybe it is easier to make first a site to site SSTP and you have to put a route in it so the traffic knows where to go.

https://wiki.mikrotik.com/wiki/Manual:I ... -Site_SSTP

Thanks for your reply
The picture shows I already made a site to site SSTP tunnel

IPSec policy set up to encrypt between 10.0.0.0/16 and 192.168.66.0/24 If you do this, then only traffic between 10.0.0.0/16 and 192.168.66.0/24 will pass through IPSec tunnel, nothing else. That's the problem with plain IPSec tunnels, they don't work like "normal" tunnels where you have ...

On CRS: /ip firewall nat add action=masquerade chain=srcnat out-interface=<vpn-client-interface> It will make all forwarded connections look like they come from address at server's end of tunnel and it will allow replies to be routed the correct way (back to tunnel). If you keep original source add...

Its easy. Here is how I used dst-nat to access winbox behind a public IP. /ip firewall> add action=dst-nat chain=dstnat comment="DST NAT for \"Tiny Tik\" Moms Wifi Router" \ port=31 protocol=tcp src-port="" to-addresses=192.168.1.31 to-ports=8291 add action=dst-nat cha...

Just connect to your router through a VPN on your phone. I can do this easily on my android, and then view it that way. Thanks for your reply. I've done that using my android phone, and it works fine. Matter is this cameras belong to a customer. She doesn't know (nor want to learn) how to connect t...

This: /ip firewall nat add action=masquerade chain=srcnat Should be more specific, for example add the out-interface otherwise it will NAT everything. You can also put more specific rules before the masquerade, so you are sure the latter will not interfere. To better understand this situations I fi...

I've added a NAT rule on the RouterOS to forward port 1022 to the SSH server: /ip firewall nat add action=dst-nat chain=dstnat dst-port=1022 in-interface=ovpn-sw1 protocol=tcp to-addresses=192.168.0.136 to-ports=1022 I've also added these rules to route back the response packets to the Linux server...

NVR needs to know where to send the reply packet, so the router on remote site it should have the gateway through the VPN. If you cannot do this, you can workaround by src-nat the packet with an IP from the local router (e.g. 192.168.77.1) which is reachable from the NVR. I can access the router on...

I know this has a solution, I've read a lot of them but do not know how to implement them. Some solutions I've tried: 1.- Mangle in the remote site router and redirect through a route: https://forum.mikrotik.com/viewtopic.php?f=13&t=114319 or https://forum.mikrotik.com/viewtopic.php?t=78664#p394...

Does the packet counter for src-nat rule increment?
If you want to mark packets then you can bind to that packet mark for the src-nat to work.

No, it doesn't increment

That is what it shows when I try to connect with my smartphone from outside.
Don't know how to redirect the packets.
Is there something wrong?
Shall I change the routes in the remote site in some way?

Local site: WAN: something.sn.mynetname.net LAN: 192.168.77.1/24 VPN: 10.10.10.1 /ip firewall nat add action=masquerade chain=srcnat add action=dst-nat chain=dstnat comment=NVR port forward dst-port=6060 protocol=tcp to-addresses=192.168.10.102 to-ports=6060 [admin@MikroTik] /ppp active> print Flag...

You then need to match the packets you already dst-natted.

How to match the packets?

Thanks for your help.

I added that rule but no success.

I read something about marking packets, I've tried that too but maybe I am doing something wrong cause still can't see the cameras.

Can you help me with an example of how to do that in Winbox?

Hello, I need to view remote ip cameras using a mobile phone app. NVR is in remote site, can't access through public ip. Remote site 192.168.10.0/24 and local site 192.168.77.0/24 connected through VPN SSTP I can access remote site with no problem if connected to my local site, so VPN works. I would...

Hi, I have a hAP ac RouterBOARD 962UiGS-5HacT2HnT Bad wirelss performance. I did /interface wireless export compact: # sep/09/2017 18:35:49 by RouterOS 6.40.3 # software id = LQRI-ZAIT # # model = RouterBOARD 962UiGS-5HacT2HnT # serial number = 6737054B278D /interface wireless set [ find default-nam...

Create a DNS name like: /ip dns static add name=www.facebook.com address=127.0.0.1 Or to an IP with web server and block page. It's a solution instead of layer 7, like normis said. Sent from my XT1225 using Tapatalk Hi, I did this redirecting facebook requests to my web server 192.168.0.3 (IIS) Wit...

I can connect from one place but not from another using exact same configuration, same notebook, same ISP, just different public ip address.

VPN client windows 10
VPN settings automatic using user and password

Hi, I am using Windows 10 to establish a VPN connection from my notebook to a RB951G-2HnD placed in my office. When in my apartment everything works excellent and connection is inmediate, but when in my brother's apartment (Same ISP, same client notebook, etc) or somewhere else I can't establish tha...