Access to Mikrotik behind the ISP router's NAT with dynamic IP

RouterOS Beginner Basics
1

Hello!
I have an ISP router with NAT and dynamic IP.
I want to set up VPN Server on the Mikrotik (MT will be connected to the ISP router) and connect to VPN provided by MT by DDNS (form Mikrotik) from outside.

My plan:

  • setup DDNS on Mikrotik and configure the VPN.
  • enable port forwarding on the ISP router for configured VPN port on the Mikrotik.
  • enjoy the result: I am able to connect to VPN by DDNS address.

Is this a real plan?
Will it work?
Do I need port forwarding on ISP router or maybe DDNS configured on MT is enough?

2

(Obviously if your Router have already one Public IP address, there are no prblems)

Until you can open port(s) on ISP router, is all feasibile.

If you can not open port on ISP router, you can only instaurate VPN FROM MikroTik to another device with Public IP or DDNS.

3

The IP on ISP router is dynamic.
I want to configure DDNS on MT router that is behind the ISP router (which with dynamic IP).
is it sounds ok?
Do I need port forwarding on ISP router if I have DDNS configured on MT?

4

read what you quoted…

5

DDNS just points hostname to address, it doesn’t open any ports, so yes, you need to forward ports from ISP router to MT.

6

Ok, thanks=)
I got it!

7

I think what Sob and rextended are missing in this discussion is your desire to use the IP cloud service on the router.
However if it is the client for Wireguard for example, its the ISP routers ISP address you need and one can add a free dydns type service to that WANIP etc…

However here is the interesting tidbit, on my ip cloud for a Switch behind the router, the homeIP is the actual ISP of the IP address. So technically I could use the IP cloud URL for the switch as an entry argument for a wireguard client endpoint address.
This means one could use the ip cloud of a device behind the router for certain things…
However as noted, one still has to forward the ports from the ISP to the secondary device for traffic flow (port forwarding_.

8

Hm.
Last question regarding this topic!
I need to forward only the VPN port (Wireguard port that is used by MT) in ISP Router, is it right?

9

Hi,

try ZEROTIER.

10

If VPN is all you need to connect, then fowarding just the right VPN port is enough.

11

Assuming you are using the MT device behind your ISP device as the server in a connection…
Yes, just port forward the port to the MT WANIP which is the same as the LANIP of the MT device on the ISP router network.
you will need a input chain rule for that port allowing access to that port UDP


If you have clients coming in on your wg connection and expecting internet access you will have another issue to deal with.
You have to source nat the clients to the IP address of the MT device so that the ISP router knows where to send return traffic from the internet.

This topic covers everything Wireguard… Para 8 applies but all of it is a good read for understanding.
https://forum.mikrotik.com/viewtopic.php?t=182340

12

Thanks for useful link and explanation!