API behind a router

RouterOS Scripting
1

So I have some APIs in php that create my users with what ever they enter for a user name and room number. This all runs off of my linux server and runs well as long as the mikrotik is the head end router. As soon as I put it behind another router I have to port forward the api port down to this mikrotiks ip address which is not ideal. So i am trying to figure out the following.

  1. Can I put my PHP files with the api call directly into my mirktoik file list.
  2. Can I call this apis from my browser? if so how? the code I currently use to call them is
    include_once(“../utils/mikrotik/api_mikrotik.php”);

what would I change this to in order to direct it locally?

could I use my local dgw address or the dns name it resolves to locally?
include_once(“../192.168.1.1/mikrotik/api_mikrotik.php”);

Any help would be great

2

  1. You can put them there, but you can't run them from there, which is what you're really wanting to do here.

  2. There is an ActionScript (read: Adobe Flash) API client, which would allow you to do just that. You still serve the page from your web server, but run the API related code on the client device. Alternatively, you could use an API client in JAVA, and write an applet for that. It would have the same effect as an ActionScript application.

Either way, this is not ideal either, because mobile devices don't have Flash or web JRE. You'd need to create separate apps for mobile devices if you want to support them. If they were just using the web page, and letting your server do the work, they won't need an extra runtime beyond a web browser (which they all have).

\

One solution to the NAT problem is to set up the web server and router(s) in a VPN. Set up the web server itself as the VPN server (or perhaps a 3rd device that both the web server and the router(s) can access), and make everyone else connect to that VPN server. RouterOS supports several VPN protocols you could use.

3

Ok since I already had this remote routers vpn back to a office mikrotik. I put a test webserver in the vpn mix. I stillhave the same problem though. For my API code to work I have to port forward the API port down to my vpn IP address. My guess is my VPN server mikrotik is doing something with the port even though I do not have the API enabled on it. ANy thoughts?

4

If your web server and target router are both in the same VPN, you should be able to access the router with its VPN IP address and port, thus avoiding the port forward. If you were to access the VPN server’s IP, yes, you’d need to do port forward, since the VPN server treats this as connections to it, not one of its VPN clients.

In all honesty, I haven’t personally used VPN, but I’ve read and seen a lot about it (including anecdotes from other network admins), and in theory, it should be the solution.