ftp and rdp not working

RouterOS Beginner Basics
1

wan is ppoe client on lan1.
masq is on wan ppoe.
for now all internet is working except ftp sites and reaching rdp destination.
i am new.
i put in dst nat rule for one ftp server and then from my network this ftp is working.
what i am doing wrong?

/ip route print detail
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
0 ADS dst-address=0.0.0.0/0 gateway=89.201.192.1
gateway-status=89.201.192.1 reachable via pppoe-out1 distance=0
scope=30 target-scope=10

1 ADC dst-address=89.201.192.1/32 pref-src=89.201.193.162 gateway=pppoe-out1
gateway-status=pppoe-out1 reachable distance=0 scope=10

2 ADC dst-address=192.168.0.0/24 pref-src=192.168.0.1 gateway=bridge1
gateway-status=bridge1 reachable distance=0 scope=10

2

I don’t know what you did wrong with your config, but I can tell you what you are doing wrong now - you’re not giving us enough info about your config. Your problem is probably with firewall rules, but we don’t see them. So try “/ip firewall export” (or whole “/export hide-sensitive” can’t hurt either) and post the output.

3

Thx for your time.
/export hide-sensitive

jun/13/2017 18:24:44 by RouterOS 6.39.1

software id = xxxxxx

/interface bridge
add fast-forward=no name=bridge1
/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-out1
use-peer-dns=yes user=biosict1@optinet
/interface virtual-ethernet
add arp=enabled disabled=no mac-address=02:B9:D0:2B:31:75 mtu=1500 name=vpn1
/ip neighbor discovery
set ether1 discover=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=
allowed mode=dynamic-keys name=profile1 supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no frequency=auto mode=
ap-bridge security-profile=profile1 ssid=BIOS-ICT tx-power=29 tx-power-mode=
all-rates-fixed
/ip firewall layer7-protocol
add name=torrent-wwws regexp="^.(get|GET).+(torrent|thepiratebay|isohunt|enterta
ne|demonoid|btjunkie|mininova|flixflux|torrentz|vertor|h33t|btscene|bitunity|
bittoxic|thunderbytes|entertane|zoozle|vcdq|bitnova|bitsoup|meganova|fulldls|
btbot|flixflux|seedpeer|fenopy|gpirate|commonbits|rarbg|torrentz|themobilebay
).$"
add name=torrent-dns regexp="^.+(torrent|thepiratebay|isohunt|entertane|demonoid|
btjunkie|mininova|flixflux|torrentz|vertor|h33t|btscene|bitunity|bittoxic|thu
nderbytes|entertane|zoozle|vcdq|bitnova|bitsoup|meganova|fulldls|btbot|flixfl
ux|seedpeer|fenopy|gpirate|commonbits|rarbg|torrentz|themobilebay).*$"
/ip pool
add name=pool1 ranges=192.168.0.100-192.168.0.150
add name=dhcp_pool1 ranges=192.168.0.100-192.168.0.150
add name=vpn_pool ranges=10.133.0.2-10.133.0.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=bridge1 lease-time=1d name=
dhcp1
/ppp profile
set *FFFFFFFE local-address=vpn_pool remote-address=vpn_pool
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=wlan1
/interface l2tp-server server
set authentication=mschap1,mschap2 caller-id-type=ip-address use-ipsec=yes
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.0.1/24 interface=ether2 network=192.168.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no
interface=ether1
/ip dhcp-server network
add address=192.168.0.0/24 dns-server=192.168.0.1 gateway=192.168.0.1
/ip dns
set allow-remote-requests=yes cache-size=32768KiB servers=8.8.8.8,8.8.4.4
/ip firewall address-list
add address=192.168.0.1-192.168.0.255 list=local_lan
/ip firewall filter
add action=reject chain=forward dst-address=!192.168.0.1 dst-port=53 protocol=
udp reject-with=icmp-network-unreachable src-address-list=!10.133.0.1/16
add action=drop chain=forward comment="block torrent wwws" layer7-protocol=
torrent-wwws
add action=drop chain=forward comment="block torrent dns" dst-port=53
layer7-protocol=torrent-dns protocol=udp
add action=drop chain=forward connection-state=invalid
add action=drop chain=input connection-state=invalid
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=185.58.73.27 dst-port=21 protocol=
tcp src-address-list=local_lan to-addresses=185.58.73.27 to-ports=21
add action=masquerade chain=srcnat src-address-list=local_lan
add action=dst-nat chain=dstnat dst-port=5500 protocol=tcp to-addresses=
192.168.0.2 to-ports=5500
add action=dst-nat chain=dstnat dst-port=5631 protocol=tcp to-addresses=
192.168.0.3 to-ports=5500
add action=dst-nat chain=dstnat dst-port=143 protocol=tcp to-addresses=
192.168.0.4 to-ports=5500
add action=dst-nat chain=dstnat dst-port=3389 protocol=tcp to-addresses=
192.168.0.5 to-ports=5500
add action=dst-nat chain=dstnat dst-port=6112 protocol=tcp to-addresses=
192.168.0.6 to-ports=5500
add action=dst-nat chain=dstnat dst-port=6113 protocol=tcp to-addresses=
192.168.0.7 to-ports=5500
add action=dst-nat chain=dstnat dst-port=22000 protocol=tcp to-addresses=
192.168.0.3 to-ports=22000
add action=dst-nat chain=dstnat dst-port=21 protocol=tcp to-addresses=
192.168.0.199 to-ports=21
/ip firewall service-port
set ftp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
/ppp secret
add name=name profile=default-encryption
/snmp
set enabled=yes
/system clock
set time-zone-name=Europe/Zagreb
/system identity
set name=xxxxx
/system leds
set 5 interface=wlan1
/system routerboard settings
set init-delay=0s
/tool graphing interface
add interface=pppoe-out1

4

Take your RDP rule for example:

/ip firewall nat
add action=dst-nat chain=dstnat dst-port=3389 protocol=tcp to-addresses=192.168.0.5 to-ports=5500

It tells router to watch for connections to tcp port 3389 and forward them to 192.168.0.5:5500. Do you see what’s missing? It does not say anything about original destination, so it will take any connection to port 3389, no matter from or where it goes. Incoming, outgoing, everything. You need to set some limits. If you have dynamic public address, add dst-address-type=local to this rule (and also other dstnat rules).

5

You are right. This was problem for rdp and ftp. Thx.
How can I filter port mapping for incoming traffic only from my wan? What is incoming interface and what is second? Idea for filtering by ip range is not good i think. I have two pools. One for my lan. Second one for my vpn.

6

If you want it to work from one interface only, there’s in-interface= parameter.