Hi All,
I need some help accessing my CCTV cameras externally through my MikroTik router:
CCTV IP Address - 192.168.88.185 port 9000
DDNS IP Address - 196.202.xxx.xxx
not sure how to get this to work so i can view my cameras via webgui ?
Please help
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT
Port Mapping/Forwarding
Your rule would look like this.
/ip firewall nat
add chain=dstnat dst-address=196.202.xxx.xxx dst-port=9000 action=dst-nat protocol=tcp to-address=192.168.88.185 to-port=9000
And if you want to access the CCTV using the DDNS from your local network you will need to add a Hairpin NAT.
http://wiki.mikrotik.com/wiki/Hairpin_NAT
/ip firewall nat
add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.185 out-interface=LAN action=masquerade
You will need to change the out-interface to match your local network interface.
thank you very much that worked perfectly 
Hy,
I’ve followed instructions but no luck. 
We have static IP address outside, 98.xxxxxx, pc with video surveilance has a static ip inside 192.xxxxx. I can access my router from web, but how to access video PC? 
Tried some forwarding rules on “ip>firewall>nat” but no luck. While playing, I’ve disabled RDP connection to server.
Thx,
Post the results from terminal for:
/ip firewall export
[admin@MikroTik] > ip firewall export
/ip firewall filter
add action=accept chain=input comment="default configuration" protocol=icmp
add action=accept chain=input comment="default configuration"
connection-state=established,related
add action=drop chain=input comment="default configuration" in-interface=
ether1-gateway
add action=accept chain=forward comment="default configuration"
connection-state=established,related
add action=drop chain=forward comment="default configuration"
connection-state=invalid
add action=drop chain=forward comment="default configuration"
connection-nat-state=!dstnat connection-state=new in-interface=
ether1-gateway
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration"
out-interface=pppoe-out1
add action=dst-nat chain=dstnat in-interface=pppoe-out1 log=yes protocol=tcp
to-addresses=192.168.1.230 to-ports=80
[admin@MikroTik] >
And now I can’t accses server over RDP
Solved this problem.. Camera accses stil trying.
The 2 firewall rules that have in-interface=ether1 should be changed to in-interface=pppoe-out1 for the rules to work properly. But before you change:
/ip firewall filter
add action=drop chain=input comment="default configuration" in-interface=ether1
If you need remote acces you need an accept rule for your remote IP or use an address list with remote IP’s.
If you access your camera system on port 80, then you need to change the web port of the router to something else like 8080. You can change this under /ip services. Then you dst-nat rule should work properly.
Didin't make it.
This is the latest situation:
[admin@MikroTik] > /ip firewall export
/ip firewall filter
add action=accept chain=input comment="default configuration" protocol=
icmp
add action=accept chain=input comment="default configuration"
connection-state=established,related
add action=drop chain=input comment="default configuration" in-interface=
ether1-gateway
add action=accept chain=forward comment="default configuration"
connection-state=established,related
add action=drop chain=forward comment="default configuration"
connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration"
out-interface=pppoe-out1
With this situation I can accses router, which I dont need, I need server which is on 192.168.1.2 to use RDP and oracle connections.
If I add
ip-firewall-nat chain-dstnat protocol- 6 tcp in interface - pppoe out1 action - dst nat to adress - 192.168.1.2
I can accses server and oracle, but outgoing connectios are blocked.. this rule was working ..what happend..i don't know..