Forward Mail Traffic

RouterOS Beginner Basics
1

Hi!
I have 2 Mikrotiks RouterOS in 2 different networks.
One Mikrotik works fine. The second Mikrotik has problems.
I have a static WAN IP and an internal Exchange Server. I want to work with IMAP also. So I created a rule to forward the Traffic on Port 993.
dst-nat tcp 993
action: dst-nat, to-address: xxxxx, to-port: 993
Internal everything works fine, but I can’t access from outside.
Other Port Forwarding works fine.

Second Question.
I want to open the port for remote access via winbox.
chain: input, src WAN IP, tcp, 8291
action: accept
On one mikrotik it works fine, the other mikrotik have no remote access.

Thanks a lot Markus

2

Cab you share with us your Firewall (Filter/NAT) config?

3

Here is my configuration:
XXX.XXX.XXX.XXX is the external WAN IP

Thanks Markus

/ip firewall filter
add action=jump chain=input disabled=no jump-target=svcIcmp
add action=jump chain=input disabled=no jump-target=svcEstablishedAndRelated
add action=jump chain=input disabled=no in-interface=ether1 jump-target=
inpWan
add action=jump chain=inpWan disabled=yes jump-target=svcWinbox src-address=
XXX.XXX.XXX.XXX/28
add action=jump chain=inpWan disabled=no jump-target=svcOpenvpn
add action=jump chain=inpWan disabled=no jump-target=svcPPTP
add action=log chain=inpWan disabled=no log-prefix=“”
add action=drop chain=inpWan disabled=no
add action=return chain=inpWan disabled=no
add action=jump chain=forward disabled=no jump-target=svcIcmp
add action=jump chain=forward disabled=no jump-target=
svcEstablishedAndRelated
add action=jump chain=forward disabled=no jump-target=fwdHqLanInbound
out-interface=br-lanWlan
add action=jump chain=fwdHqLanInbound disabled=yes dst-address=10.136.0.20
jump-target=svcRdp
add action=jump chain=fwdHqLanInbound disabled=no dst-address=10.136.0.20
jump-target=svcHttps
add action=accept chain=fwdHqLanInbound comment=
“fixen, ICMPs generell akt., Gr\F6\DFe Linknetz einschr\E4” disabled=no
src-address=10.136.3.0/24
add action=log chain=fwdHqLanInbound disabled=no log-prefix=“”
add action=drop chain=fwdHqLanInbound disabled=no
add action=return chain=fwdHqLanInbound disabled=no
add action=accept chain=svcWinbox disabled=no dst-port=8291 protocol=tcp
add action=return chain=svcWinbox disabled=no
add action=accept chain=svcHttps disabled=no dst-port=443 protocol=tcp
add action=return chain=svcHttps disabled=no
add action=accept chain=svcRdp disabled=yes dst-port=3389 protocol=tcp
src-port=“”
add action=return chain=svcRdp disabled=yes
add action=accept chain=svcIcmp disabled=no protocol=icmp
add action=return chain=svcIcmp disabled=no
add action=accept chain=svcOpenvpn disabled=no dst-port=1194 protocol=tcp
add action=return chain=svcOpenvpn disabled=no
add action=accept chain=svcPPTP disabled=no dst-port=1723 protocol=tcp
add action=return chain=svcPPTP disabled=no
add action=accept chain=svcEstablishedAndRelated connection-state=established
disabled=no
add action=accept chain=svcEstablishedAndRelated connection-state=related
disabled=no
add action=return chain=svcEstablishedAndRelated disabled=no
add action=accept chain=forward comment=“ev f\FCr imap verbindung notwendig”
disabled=yes dst-address=10.136.0.20 dst-port=993 protocol=tcp
add action=accept chain=forward disabled=yes dst-address=10.136.0.20
dst-port=25 protocol=tcp
add action=accept chain=input disabled=yes protocol=icmp
add action=accept chain=input connection-state=established disabled=yes
add action=accept chain=input connection-state=related disabled=yes
add action=accept chain=input comment=“admin access” disabled=yes dst-port=
8291 protocol=tcp



/ip firewall nat
add action=masquerade chain=srcnat comment=“default configuration” disabled=
no out-interface=ether1 to-addresses=0.0.0.0
add action=dst-nat chain=portFwdWanSua disabled=yes dst-port=3389 protocol=
tcp to-addresses=10.136.0.20
add action=dst-nat chain=portFwdWanSua disabled=no dst-port=443 protocol=tcp
to-addresses=10.136.0.20
add action=return chain=portFwdWanSua disabled=no
add action=jump chain=dstnat disabled=no in-interface=ether1 jump-target=
portFwdWanSua
add action=dst-nat chain=portFwdWanSua comment=“ev fuer imap notwendig”
disabled=yes dst-port=143 protocol=tcp src-port=“” to-addresses=
10.136.0.20
add action=dst-nat chain=portFwdWanSua disabled=no dst-address=XXX.XXX.XXX.XXX
dst-port=993 protocol=tcp to-addresses=10.136.0.20 to-ports=993