/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN src-address=
x.x.x.x/24
add action=masquerade chain=srcnat out-interface=ether1-WAN src-address=
y.y.y.y/24
add action=masquerade chain=srcnat out-interface=ether1-WAN src-address=
z.z.z.z/22
add action=dst-nat chain=dstnat connection-type=“” dst-address=a.a.a.a
dst-port=2000-2015 in-interface=ether1-WAN protocol=tcp to-addresses=
y.y.y.y
so all is done the write way i did this hundreds of times on other mikrotik powered sites and no problems . If i open 3389 it woks fine but non of 2000 or 3000 ports would be open.
Any ideas???
- ISP can be blocking some ports (check dstnat rule’s packet counter if there’s incoming traffic)
- you may have some mistake in “/ip firewall filter” (check with torch or logging rule in postrouting if packets pass through router)
- there can be some problem on a.a.a.a, service not running or blocked by device’s own firewall
have contacted ISP they have said they are not blocking ports.
yes packets are coming in then i test is port open or not
could you be more specific on “you may have some mistake in “/ip firewall filter” (check with torch or logging rule in postrouting if packets pass through router)”
a.a.a.a (external static IP) isn’t blocked for sure. We have got this IP just yesterday.
add action=dst-nat chain=dstnat *connection-type=“” dst-address=a.a.a.a *
dst-port=2000-2015 in-interface=ether1-WAN protocol=tcp to-addresses=
y.y.y.y
Other than the bolded bit your rule looks right, not saying the bolded part is incorrect just dont use it.
For your information, all ports with dstnat rules will appear on scans as visible but closed.
all dstnat rules that include a source-address-list (defined allowed wanips with entry) will NOT appear on scans (are invisible).
took away balded part still the same even got ip changed form ISP, all this makes me crazy
post your complete config
/export hide-sensitive file=yourlatestconfig
mar/08/2019 19:50:36 by RouterOS 6.44
software id = GJR0-2DJD
model = RouterBOARD 3011UiAS
serial number = xxxxxxxxxx
/interface bridge
add arp=proxy-arp name="bridge LAN"
add name="bridge LAN CCTV"
add name="bridge1-Front TV's"
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN speed=100Mbps
set [ find default-name=ether2 ] speed=100Mbps
set [ find default-name=ether3 ] speed=100Mbps
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
set [ find default-name=ether6 ] speed=100Mbps
set [ find default-name=ether7 ] speed=100Mbps
set [ find default-name=ether8 ] speed=100Mbps
set [ find default-name=ether9 ] speed=100Mbps
set [ find default-name=ether10 ] speed=100Mbps
set [ find default-name=sfp1 ] advertise=
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/interface vlan
add interface="bridge LAN" name=vlan-Guest vlan-id=1010
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name="Pool LAN x.x.x.x" ranges=x.x.x.x-x.x.x.x
add name="Pool CCTV LAN x.x.x.x" ranges=x.x.x.x-x.x.x.x
add name="Pool Guest Wifi" ranges=x.x.x.x-x.x.x.x
add name="pool-TV's" ranges=x.x.x.x-x.x.x.x
/ip dhcp-server
add add-arp=yes address-pool="Pool LAN x.x.x.x" disabled=no interface=
"bridge LAN" name="LAN "
add address-pool="Pool CCTV LAN x.x.x.x" disabled=no interface=
"bridge LAN CCTV" name="CCTV LAN"
add address-pool="Pool Guest Wifi" disabled=no interface=vlan-Guest name=
"Public WIFI"
add address-pool="pool-TV's" disabled=no interface="bridge1-Front TV's" name=
"server1-TV's"
/snmp community
set [ find default=yes ] addresses=x.x.x.x/32,x.x.x.x/24
/interface bridge port
add bridge="bridge LAN" interface=ether2
add bridge="bridge LAN" interface=ether3
add bridge="bridge LAN" interface=ether4
add bridge="bridge LAN CCTV" interface=ether5
add bridge="bridge LAN CCTV" interface=ether6
add bridge="bridge LAN CCTV" interface=ether7
add bridge="bridge1-Front TV's" interface=ether8
add bridge="bridge1-Front TV's" interface=ether9
/ip address
add address=x.x.x.x/24 interface="bridge LAN" network=x.x.x.x
add address=x.x.x.x/24 interface="bridge LAN CCTV" network=
x.x.x.x
add address=x.x.x.x/22 interface=vlan-Guest network=x.x.x.x
add address=x.x.x.x/24 interface="bridge1-Front TV's" network=
x.x.x.x
add address=x.x.x.x./30 interface=ether1-WAN network=x.x.x.x
/ip dhcp-server network
add address=x.x.x.x/22 dns-server=8.8.8.8,8.8.4.4 gateway=x.x.x.x
add address=x.x.x.x/24 dns-server=x.x.x.x gateway=
x.x.x.x
add address=x.x.x.x/24 dns-server=8.8.8.8,8.8.4.4 gateway=
x.x.x.x
add address=x.x.x.x/24 dns-server=8.8.8.8,8.8.4.4 gateway=
x.x.x.x
/ip dns
set allow-remote-requests=yes cache-max-ttl=1h servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=x.x.x.x list=SNMP
add address=x.x.x.x/24 list=winbox
add address=x.x.x.x list=winbox
add address=x.x.x.x/24 list=winbox
add address=x.x.x.x/24 list=SNMP
add address=x.x.x.x list=icmp
add address=x.x.x.x/24 list=icmp
add address=x.x.x.x/24 list=icmp
add address=x.x.x.x list=winbox
add address=x.x.x.x list=icmp
add address=x.x.x.x list=SNMP
add address=x.x.x.x list=icmp
add address=x.x.x.x list=winbox
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=ether1-WAN protocol=tcp
add action=drop chain=input dst-port=53 in-interface=ether1-WAN protocol=udp
add action=drop chain=forward dst-port=53 out-interface=!ether1-WAN protocol=
tcp
add action=drop chain=forward dst-port=53 out-interface=!ether1-WAN protocol=
udp
add action=drop chain=forward comment="LAN to CCTV" dst-address=
x.x.x.x/24 src-address=x.x.x.x/24
add action=drop chain=forward comment="CCTV to LAN" dst-address=
x.x.x.x/24 src-address=x.x.x.x/24
add action=drop chain=forward comment="Public to LAN" dst-address=
x.x.x.x./24 src-address=x.x.x.x/22
add action=drop chain=forward comment="LAN to Public" dst-address=
x.x.x.x/22 src-address=x.x.x.x/24
add action=drop chain=forward comment="Publick to CCTV" dst-address=
x.x.x.x/24 src-address=x.x.x.x/22
add action=drop chain=forward comment="CCTV to Public" dst-address=
x.x.x.x/22 src-address=x.x.x.x/24
add action=drop chain=forward dst-address=x.x.x.x/24 src-address=
x.x.x.x/24
add action=drop chain=forward dst-address=x.x.x.x/24 src-address=
x.x.x.x/24
add action=drop chain=forward dst-address=x.x.x.x/24 src-address=
x.x.x.x/24
add action=drop chain=forward dst-address=x.x.x.x/24 src-address=
x.x.x.x/24
add action=drop chain=forward dst-address=x.x.x.x/22 src-address=
x.x.x.x/24
add action=drop chain=forward dst-address=x.x.x.x/24 src-address=
x.x.x.x/22
add action=accept chain=input dst-port=161,162 protocol=udp src-address-list=
SNMP
add action=accept chain=input dst-port=8291 protocol=tcp src-address-list=
winbox
add action=accept chain=input dst-port=500,1701,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=forward protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
src-address-list=icmp
add action=accept chain=input comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN"
in-interface=ether1-WAN
add action=accept chain=forward comment="IPSec OUT" ipsec-policy=out,ipsec
add action=accept chain=forward comment="IPSec IN" ipsec-policy=in,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack"
connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related"
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid"
connection-state=invalid
add action=drop chain=forward comment=
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat
connection-state=new in-interface=ether1-WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-WAN src-address=
x.x.x.x/24
add action=masquerade chain=srcnat out-interface=ether1-WAN src-address=
x.x.x.x/24
add action=masquerade chain=srcnat out-interface=ether1-WAN src-address=
x.x.x.x/22
add action=dst-nat chain=dstnat dst-address=x.x.x.x dst-port=2000-2015
in-interface=ether1-WAN protocol=tcp to-addresses=x.x.x.x
/ip route
add distance=1 gateway=x.x.x.x
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=""
set ssh disabled=yes
set winbox address=""
/snmp
set enabled=yes trap-generators=temp-exception,temp-exception trap-version=2
/system clock
set time-zone-name=Europe/
/system identity
set name=MikroTik-
Okay some things I noted.
In general only use the word LAN for one particular purpose you have LAN all over the place and its confusing.
(1)/interface bridge port for WIFI missing (and by the way ethernet definition for wlan also missing)???
something like
/interface bridge port
add bridge=bridge LAN interface=WLAN1 pvid=1010 ingress filtering=yes admit-frames-only-untagged-priority
(2) Missing /interface bridge vlan setting
add bridge=bridge-lan tagged=bridge LAN untagged=wlan1 vlan-id=1010
(3) Bridge LAN definition needs vlan-filtering=yes
I wont bother getting into the firewall rules. I think people are making a complete shambles of these.
Its quite simple
input chain
Default settings for the most part
add admin access to router
add all that need dns access on LAN side to router tcp/udp
Add Drop all last rule
Default settings
add lan to wan traffic
add vlan to wan traffic
allow admin access to all lans/vlans
allowed shared devices if necessary
allow port forwarding if necessary
Add Drop all last rule
duplicate post
I dont need bridge for wifi !!! vlan 1010 via LAN bridge does all the job in trunk with a managed switch all is good with bridges and wifi vlan 
firewall is basic with some adds to secure access and in between LAN’s you better tell me why ports are not opened?
why duplikate post ?
Means I accidentally posted the same thing twice!
Please provide a diagram as I do not understand your setup.
You can either use Tools->Torch on interface where y.y.y.y is connected to and look for packets to y.y.y.y:<2000-2015> or you can do the same using logging rule:
/ip mangle
add chain=postrouting dst-address=y.y.y.y protocol=tcp dst-port=2000-2015 action=log
If you see any packets, it means they successfully passed through firewall and you should check config on y.y.y.y device (I wrote a.a.a.a by mistake in previous reply, but I meant y.y.y.y). If you don’t, then the firewall on router should be responsible for their disappearance. It doesn’t look like it, but it’s not like anyone can be sure that it’s not matched by some of those drop rules between x.x.x.x/22-4 and x.x.x.x/22-4 (i.e. I’d say it’s better to not mask non-public addresses when posting config).
thanks for the reply,
thanks for mangle rule, yes it register or logs packets coming via firewall from outside (internet). Those hidden x.x.x.x are just 3 Local LAN’s. There are 3 bridges, bridge LAN admin LAN , Bridge CCTV other LAN for CCTV, and Bridge TV’s just the 3rd LAN for specific devices and VLAN public for wifi it goues via Bridge LAN trunked with manage switch , AP’s are connected to that switch. So all those forward drop rules are just to make sure local LAN’s are not able to tack to each other.
Bridge CCTV is connected to CCTV switch and NVR is connected to that switch so ports are opened to access this NVR remotelly via CCTV software. We have many sites with similar or the same configurations and no problems occurs anywhere .
akarpas
I dont think you need any of those rules for the following reasons.
Layer two separation is achieved by
using different LANs, using Bridges, using VLANS.
Thus two LANS are not layer 2 connected
Two Bridges are not layer 2 connected
A lan(subnet) and a bridge are not layer two connected
A VLAN is separated from other VLANS or LAN on the same bridge, let alone different bridges etc…
The real concern then becomes multiple LANs on a bridge.
So the result to achieve layer 2 separate between two lans is dont put them on the same bridge.
Put LANS on different bridges or one on a bridge and one off a bridge etc… and use vlans where you really want to separate functionality within the same bridge.
Okay so then we come to Layer 3 firewall rules (mostly filter forward chain for the discussion - going across the router).
We are going to solve that by explicitly dropping all L3 traffic, routing and only allowing what is legitimate.
USE a schema of Drop everything and only allow required traffic.
So the forward filter chain should look like something as follows:
(default rules which are fine)
allow fasttrack established related
allow established related
drop invalid
drop all else
Thats it!!
No LANA to LANB or LAN to VLAN or VLAN to LAN traffic etc is permitted at layer 3. The router will not find and send traffic between these entities.
How many rules was that LOL?
Now here ********************* is where you stick in the traffic flow you want to allow. NO NEED to have a gazillion block or drop rules!!! KISS mate!!
for example
LANA to WAN
VLANB to WAN
admin access to all VLANs
VLANS access to a shared printer on LANA
Allow port forwarding (for some dstnat rules).
I think you get the idea. Dont worry about what you dont want to happen, way too complex and confusing for anyone trying to understand your setup.
Just allow what is permitted. Much cleaner.
Have attached simple network diagram
All LAN’s and VLAN are on different broadcast’s and all this is ok next is L3 , because all local networks connected to local interfaces are able to communicate until you stop it in mikrotik is done via firewall, in cisco devices via ACL’s specifically on on L3 switches. Its just to stop local networks communicating to each other all works fine no problems and extra rules on dropping forwards locally doesnt have impact on performance 
We are talking not about the problem i have as i have switched firewall at all deactivated all rules and ports are still not opening
and again mikrotik device is combination of router and switches anything connected even virtual interface (bridge) has MAC so everything is L2 connected.
Well unfortunately either I have an incorrect knowledge of L2 and L3 on MT routers or you do LOL.
Since I know my own routers functionality according to the rules I noted above do hold true, and I am relying on facts, not assumptions.
In any case not part of the issue, thanks for an excellent diagram!!
So it looks like the router goes to managed switches for the most part except for the Media Devices.
You use bridges and LANS throughout and only use one VLAN (1010).
Based on the diagram I dont see any issues with your config. The only thing that is not clear is the mess of firewall rules but as you state, they work elsewhere.
What I would do is a completely separate setup USE ONE BRIDGE and vlans to separate the uses…
I cannot provide any more guidance (out of ideas) 
.
That mangle rule sees packets from outside that already passed through router and are leaving via the interface where y.y.y.y is connected to. You try reverse rule, to see if anything is coming back:
/ip mangle
add chain=prerouting src-address=y.y.y.y protocol=tcp src-port=2000-2015 action=log
But it probably doesn’t and it means that y.y.y.y device is what you need to check.