Hello Mikrotik experts
I’m completely noob with Mikrotik and routerOS and I need your precious help. (so be gentle on me)
Major question Hairpin NAT
My setup is as follows: LAN > Mikrotik (with PPPoE Dialing) > MODEM > ISP (with Dynamic IP)
I have several server devices on LAN (1 NVR, 1 web based light switch, 2 IP cameras) and I have managed to forward the ports using dstnat rules. Now I can access the devices from internet using DDNS address which is updated regulary using a specific script. Everything is fine.
However I really don’t get how to setup the router to redirect my DDNS request to internal IP’s when I’m on connected to LAN.
I know that I have to setup Hairpin NAT but I can’t understand really the rule structure.
To be more specific:
My public DDNS is: mymikrotik.two-dns.de
My internal switch (web server) is running on 192.168.128.199 on port 8880
My router is on 192.168.128.1
Can anybody provide an example how to setup my firewall rules to achieve Hairin NAT?
Well I’m definitely missing something major here.
I tried few times to use the rule but “no juice”.
I tried to create two different rules for two different devices, but no success.
Any ideas?
My master interface is bridge1 (where the rule is targeting). Is this correct?
The indicated rule is targeting correctly an active device and an active port: What am I doing wrong?
The problem is your dst-nat rule. You have in-interface=pppoe-out1, which works fine for traffic coming from outside your network. However, your local traffic never hits that interface. You will need something like this:
I really don’t get the idea behind the previously provided responses…
What you need is to D-NAT the requests originating from your internal LAN towards your public IP to the internal server’s IP.
Now here we have 2 solutions:
Assuming your external IP is static (not your case, just for the concept):
Of course, in both cases, you can adapt the NAT rules to be restricted to certain ports, or use multiple different internal servers.
Here is an example script that you can adapt to get your interface IP periodically and add it to the ‘Hairpin’ address list, and should work regardless of static or dynamic IP. Just run it every minute or so:
# this is the global variable holding the last known public IP
:global HairpinPreviousIP ;
# get the current WAN IP
:local currentIP ;
:do {
:set currentIP [/ip address get [find interface="YOUR_WAN_INTERFACE"] address] ;
} on-error={
# you could add a failover static IP here, just have something so the script won't fail
:set currentIP 192.168.128.199 ;
}
# Strip the net mask off the IP address
:for i from=( [:len $currentIP] - 1) to=0 do={
:if ( [:pick $currentIP $i] = "/") do={
:set currentIP [:pick $currentIP 0 $i] ;
}
}
# Public IP has changed
:if ($currentIP != $HairpinPreviousIP) do={
# clear the address list
:foreach entry in=[/ip firewall address-list find list="Hairpin"] do={
/ip firewall address-list remove $entry
}
# add new address to the address list
/ip firewall address-list add list="Hairpin" address=$currentIP
# here you could also add other static router IPs to the Hairpin list
# /ip firewall address-list add list="Hairpin" address=192.168.1.2
# store the new IP
:set HairpinPreviousIP $currentIP ;
}
If you run a dynamic dns update script, you probably have most elements there, just migrate the delete/add IP to the ‘Hairpin’ address list to that script.
Rather than using a dst-address or a convoluted script to update the WAN IP and update the rule try using the MikroTik’s build in DDNS, enable it and copy your host name.
Go into the Firewall and create an address list and call is WAN-IP (or similar), amend your dst-nat rules so that they apply to an address-list and choose the WAN IP list you just made.
In recent RoS the address list can resolve host names so it will resolve your WAN IP and change when you swap IP (if your ISP supports dynamic)
The only issue is that there will be a hiatus after ddns update for the remainder of the DNS entry TTL (usually 5-15 minutes worst case since ddns providers use some 300-900 seconds TTL). This does not happen with the script, which limits this behavior to the script cycle.
If you can access it fine externally and not internally that’s generally a masquerade issue
Typically the default settings will masquerade the LAN traffic leaving ether1. However if you temporarily remove the ether1 from the rule and apply it my guess is that it will work fine.
If so you should be able to customize rules needed to access devices locally.
