Hairpin NAT with dynamic WAN IP

RouterOS Beginner Basics
1

Hi,
I would like to ask you to review my Hairpin NAT to internal server on 10.0.0.50
The WAN IP is dynamic (VDSL). I access my Server from Internet and also from LAN by using the domain name (WAN IP).

Option A:

/ip firewall nat
add action=masquerade chain=srcnat out-interface="PPPoE client"
add action=masquerade chain=srcnat comment="LAN to Server" dst-address=10.0.0.50 protocol=tcp src-address=10.0.0.0/25
add action=dst-nat chain=dstnat comment="WAN to https Server" dst-address-type=local dst-port=443 protocol=tcp to-addresses=10.0.0.50

Option B:

/ip firewall nat
add action=masquerade chain=srcnat out-interface="PPPoE client"
add action=masquerade chain=srcnat comment="LAN to Server" dst-address=10.0.0.50 out-interface=bridge-local src-address=10.0.0.0/25
add action=dst-nat chain=dstnat comment="WAN to https Server" dst-address=!10.0.0.0/25 dst-address-type=local dst-port=443 protocol=tcp to-addresses=10.0.0.50

I am unable to see the background if both are equal or maybe incorrect/wrong or what is the advantage of each?
But both seems to work well…

Or is there any better Option C? :slight_smile:
Thank you!

2

I made a YouTube video on this subject exactly;
https://www.youtube.com/watch?v=_kw_bQyX-3U

3

Thank you Steveocee, based on the tutorial I will try to use this now, Option C:


/ip firewall nat
add action=masquerade chain=srcnat comment="LAN to Server" dst-address=10.0.0.0/25 src-address=10.0.0.0/25
add action=masquerade chain=srcnat out-interface="PPPoE client" src-address=10.0.0.0/25
add action=dst-nat chain=dstnat comment="WAN to https Server" dst-address-list=WAN-IP dst-port=443 protocol=tcp to-addresses=10.0.0.50

/ip firewall address-list
add address=server.example.com list=WAN-IP