This must have been covered before, but if I find an example there are always some special cases that aren’t true for me (or I don’t understand the example…)
Let’s say I have a Webserver running on 192.168.1.100 Port 80 and want it to be accessible from the WAN IP 69.69.69.69 on Port 8080.
So I add a dst-nat rule and that works from the Internet.
But accessing port 69.69.69.69 port 8080 won’t work from the internal LAN. What is the easiest way to fix that?
The server is not on a seperate subnet and doesn’t have it’s own LAN Port on the Mikrotik.
If ever possible I’d like to avoid using the external IP in the rules as it may change.
MikroTik has the concept of "interfaces" which are sometimes labeled ether1, ether2, and so on. Then there can also be bridge interfaces: bridge1, etc. which may be a collection of LAN interfaces for your device. You need to understand which are your WAN and which are LAN. Once you understand that, you may use the following to configure your network. Also understand that the MikroTik device is listening on port 80 under /ip services. You'll need to change that port to be something else.
Replace all Firewall and NAT rules and then apply these. Set in-interface and out-interface correctly. #Router and internal network protection, LAN is friendly
/ip firewall filter
add chain=input action=drop connection-state=invalid comment="Disallow weird packets"
add chain=input action=accept connection-state=new in-interface=ether-LAN comment="Allow LAN access to the router itself"
add chain=input action=accept connection-state=established comment=" ^^ that originated from LAN"
add chain=input action=accept connection-state=related comment=" ^^ that originated from LAN"
add chain=input action=accept protocol=icmp comment="Allow ping ICMP from anywhere"
add chain=input action=drop comment="Disallow anything from anywhere on any interface"
add chain=forward action=drop connection-state=invalid comment="Disallow weird packets"
add chain=forward action=accept connection-state=new in-interface=ether-LAN comment="Allow LAN access to move through the router"
add chain=forward action=accept connection-state=established comment=" ^^ that originated from LAN"
add chain=forward action=accept connection-state=related comment=" ^^ that originated from LAN"
add chain=forward action=accept protocol=tcp dst-port=80 comment="Add a filter exception for port mapped server"
add chain=forward action=drop comment="Disallow anything from anywhere on any interface"
OK, I’m getting first results but this method requires one to put the WAN ip in the dst-nat rule. I’d like to avoid that, that’s why I had the incoming interface marked and not the IP. But when accessing from the inside, that rule won’t get applied. Maybe I can use 2 rules… I’ll try.
You can use dst-address-type=local in the dst-nat rule.
Something like this
add chain=dstnat dst-address-type=local protocol=tcp dst-port=8181 action=dst-nat to-address=10.0.1.4Basically that means if the dst-address is “local” to the router (e.g. it is assigned to one of the interfaces on the router).
The other option is to make a script to update it if you have DHCP or something. Just note… that means that it will also dnat things designated to the internal IP of the router too…
Hi!
That’s a great idea, unfortunately it doesn’t work for my setup. In fact I even need 2 rules. The problem is my public IP is double-NATed.
so, the mikrotik sees it’s upstream as 192.168.0.2. So if I use the dst-nat on local addresses that works when the requests come from the WAN, as they seem to have a dst. address of 192.168.0.2. But when I make the request within the LAN the request goes to the public WAN IP…
I guess there’s no easy solution for that…
Hmmm… If your interested I could write a script for you to use use HTTP to grab your IP and then update the firewall rule. You could run the script every 10 minutes or so…
Got bored… Personally I like using comments to tag rules. Basically just add “+DynamicHairpin” to the end of the comments on your hairpin rules in NAT. It will use dnsomatic via fetch to grab your actual public IP address. Then it will set the hairpin rules dst-addresses to the address. I wrote it as a loop with the comment in case you had more than one hairpin rule.
Just to note… you will have to use two rules no matter what because of your double nat… at least as far as I can tell.
:global localSite
:local currentLocalSite
:local forceUpdate false