basic port foward easily achieved by cheap routers. NOTonMT

RouterOS General
1

I’ve been fighting with this issue for a few days now.

I have a server behind my RB1100 that has HotSpot/PPPoE.
All seems to be working just fine for the MTRouter which is great.

I just need to port forward port 8787 so when i type my external IP with port 8787 (1xx.224.27.xxx:8787) it sends me to my internal server so i can get to it.

I have created the following rule:

8 ;;; port forward
chain=dstnat action=dst-nat to-addresses=192.168.8.1 to-ports=8787
protocol=tcp port=8787

yes. the server is on a different subnet (192.168.8.0/29). It also is on a different port (5)… however all is well since MT can ping it just fine:

[admin@Mikrotik] > ping 192.168.8.1
HOST SIZE TTL TIME STATUS
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
sent=5 received=5 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms

2

http://wiki.mikrotik.com/wiki/Forwarding_a_port_to_an_internal_IP

3

I don’t want to sound rude but that’s not much help. I’ve already created that rule missing only the external ip as in the example 69.69.69.69
The problem here is how can a simple cheap routes be it tp_link or linksys do what’s needed so easily while I can’t do it in RouterOS

4

What does this mean?

I have a server behind my RB1100 that has HotSpot/PPPoE.

Is the server on an interface with a hotspot?

The server is assigned 192.168.8.1/29? What is the MikroTik router interface assigned on that localnet? The reason I ask is because I normally assign an address like 192.168.8.1 to my router interface, not devices behind it.

5

The server (192.168.8.1) is on an interface thats no where near the hotspot/pppoe on the mikrotik.

Ether1 is for net.
Ether5 is for the server (192.168.8.1)
ports 6-11 are bridged to make one port and thats what the hotspot/pppoe is on.

6

That could be why it’s doesn’t work.

7

You didn’t answer my question. What ip is ether5 assigned? Are you certain the default gateway in the server is correct? It needs to be that ip.

If you want specific answers, you must provide specific information.

8

ether5 is 192.168.8.2/29

server is 192.168.8.1/29

9

Use this

add action=dst-nat chain=dstnat dst-address=pubic_ip dst-port=8787 protocol=tcp to-addresses=192.168.8.1 to-ports=8787

if static public ip is assigned to ether1

or else

add action=dst-nat chain=dstnat in-interface=ether1 dst-port=8787 protocol=tcp to-addresses=192.168.8.1 to-ports=8787

if you have changed the replace ether1 with actual port name(Case sensitive)

give +1 karma if this helped you

10

The server has 192.168.8.2 as the assigned gateway? Nothing in the firewalls (router or server) that could be blocking this?

11

Supply the in-interface like advised above and it will work.

If it doesn’t, show us /ip firewall filter export compact

Without more info you wont get much help

12

I just tested this on my router with an internal server at 192.168.1.254. It works fine without an in-interface or dst-address parameter.

/ip firewall nat
add chain=dstnat action=dst-nat dst-port=8088 to-addresses=192.168.1.254 to-ports=80 protocol=tcp

This accessed the internal server from the internet.
http://xx.xx.xx.xx:8088

edit: I also tried the same using port 80 on both, and I could access the server from the internet.

/ip firewall nat
add chain=dstnat action=dst-nat dst-port=80 to-addresses=192.168.1.254 to-ports=80 protocol=tcp

This accessed the internal server from the internet.
http://xx.xx.xx.xx

HOWEVER, this redirects all port 80 destination traffic to 192.168.1.254. The internet became unreachable from internal computers. In that case, an in-interface or dst-address would be necessary to work properly.