Hi!
I configured dst-nat to my server and I can access it from any network outside my LAN through my domain linked to the public IP. But I can’t reach the server from my LAN through domain or WAN IP. I understand the problem is that the server tries to send the package on the shortest path, but the client device expects it from wan and drops the lan package.
A post from 2015 http://forum.mikrotik.com/t/access-to-wan-ip-from-lan/93234/1 Isn’t it fixed jet?
However none of these tips helped.
You may need to implement hairpin
There is nothing to fix in bug fixing sense, because there’s nothing broken. You just need to configure your router correctly. Follow the link from last post in the other thread, add required srcnat rule and if it doesn’t help, then share more info about your exact config. It’s most likely just some little detail…
Should it work like this?
/ip firewall nat
add chain=src-nat action=src-nat to-address=<your LAN IP, for example 192.168.88.1> src-address=<your lan network, for example 192.168.88.0/24> dst-address=<your WAN IP> out-interface=<your LAN interface, most likely bridge-local>
Not exactly. Dstnat rule is applied first and it means that dst-address is now internal address of server (where you forward the port to). So you want something like this (where 192.168.88.100 is server):
/ip firewall nat
add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.100 out-interface=<LAN> action=masquerade
Or you can use one universal rule that will cover multiple internal servers:
/ip firewall nat
add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.0/24 out-interface=<LAN> action=masquerade
Using action=src-nat instead of action=masquerade (as you did) is also possible. In fact, you can use pretty much any address in to-address= and internal clients will appear like they connect from there. I myself like to use to-address= (when I have static one), but it’s just a personal preference.
Btw, also make sure that your dstnat rules are correct, e.g. one common mistake is having in-interface=, because such rules will work from WAN only.
It does not work for me.
Maybe the problem is, that mikrotik has no public IP. It has only a LAN ip assigned by a 3G gateway!
Port forward is set up on 3G and Mikrotik, still, I cannot access the LAN server from my LAN network through the public IP!
Draw a diagram including IP addresses (hand-drawn is fine), and post it with an export…
Public address somewhere else is very important detail. For that to work, you must intercept packets to your public address on router (even though it doesn’t have this public address itself) and not let them go out. I don’t know your exact dstnat rules, they might use dst-address=<router’s non-public WAN address> or dst-address-type=local, but neither will work for this. Keep it as it is (for connections from outside) and add another dstnat rule(s) like this:
/ip firewall nat
add action=dst-nat chain=dstnat dst-address-list=my_ip protocol=tcp dst-port=80 to-addresses=192.168.88.100
/ip firewall address-list
add address=<your DDNS hostname> list=my_ip
It assumes that your public address is dynamic. If not, simply use dst-address= in dstnat rule.