dst-address=192.168.20.100.0/24 doesn’t really need an explanation
it can’t have out-interface=pppoe-out1 if it’s supposed to do hairpin NAT, the correct interface would be bridge-local
But if your WAN address is really 192.168.111.111, i.e. non-public one, your problem is elsewhere. Either haipin NAT must be done by the router with public address used by your domain, or you must create another set of dstnat rules on your router with dst-address=, to catch packets early and don’t let them go out.
I just wondering if in my case the only one solution is to use local DNS services ?
This situation should be quite popular if someone is providing web services.
How do you react if user will use externall dns, for example google
Yes I’m blocking google dns and most other dns services.
Not really, it depends on your firewall setup, I have no idea what you have there. Firewall rules are processed in order, so if you want to allow something, it must happen before other rule explicitly blocks it.
Check wiki and understand what exactly happens with addresses when packets goes through router. Then just watch what happens on your router. RouterOS is great in this regard, every rule has live counters, you can add extra logging rules to prerouting, forward or postrouting, to more easily and reliably see what happens, what goes where, etc.
Check > wiki > and understand what exactly happens with addresses when packets goes through router. Then just watch what happens on your router. RouterOS is great in this regard, every rule has live counters, you can add extra logging rules to prerouting, forward or postrouting, to more easily and reliably see what happens, what goes where, etc.
I’ve followed that instruction, and I can make it work from WAN.
I have a setup where my router is behind my ISP router - would I be able to hairpin on my router, or should the ISP make it on their router?
It can be done on your router, you just need to catch packets going to public address and don’t let them go to ISP. So if currently you forward ports using dstnat rule with dst-address=<private address on your router’s WAN>, make another one with same settings and only change dst-address=.
Nothing wrong, it should work. First rule is for connections from internet and second one for connections from your LAN. The actual hairpin NAT will be same for both, using srcnat rule from wiki. You do have that too, right? If it still doesn’t work, make sure it’s not blocked in forward chain. Specifically, connection from LAN to your server (going back to LAN) will have both incoming and outgoing interfaces the same (LAN).
Then try to connect and watch what happens. Every rule has counters, so you’ll know how far the packet got. You can also enable logging for each rule. Or add extra logging rules for debugging:
in prerouting with src-address=E and dst-address=A, to confirm that request came to router
in forward with src-address=E and dst-address=D, to tell that dstnat rule worked.
in postrouting with src-address=C and dst-address=D, to see the final packet leaving the router
Verify each step and you’ll see what did not happen, even though it should have.
