So I recently bought a RB2011UAS-2HnD-IN and I guess I’m in a bit over my head, I’m having a difficult time getting this to work.
My goal is to forward some ports to various devices on my network and then use the external addresses to access them regardless of where I happen to be connected, be it at home on my local network or across the country through my cell phone. In order to do this I’m fairly certain I need to use Hairpin NAT.
My configuration is as follows:
Router has a dynamic WAN IP
Router’s internal ip is 192.168.10.1
Desktop pc on ether3 with ip 192.168.10.10
Server (forward target) on ether2 with ip 192.168.10.15
Which resulted in the port forward working externally, but if I tried to use the external address from within my network the connection was directed to my router and not forwarded beyond that.
With these rules the DST NAT is only occurring on traffic with in-interface Ether 1. You can either add another DST NAT rule to cover the locally originated traffic or change the selection criteria to cover both. e.g. if you have a static IP use that to select rather than in-interface.
Congratulations on buying a MikroTik, I'm having so much fun with mine. Understand that there are several ways to accomplish the same thing, and based on how you start will determine how you finish up. I like to do as much matching on interfaces as possible before delving into IP address and whatnot. However, I'm new to RouterOS so keep that in mind.
Using the GUI tool, go to Files and make a backup of your system. Then go to /ip firewall filter and /ip firewall nat and delete all your existing rules. Inspect these rules I've made for you below, then copy and paste them in from a New Terminal screen. Do change ether-LAN to match your interface name (which is probably ether2 in your case) and ether-WAN (which look like ether1-gateway).
Understand that should you ever want to port forward to 22 from 52 the meaning of dst-port and to-portchange based on the chain (forward, prerouting, etc) when you have masquerade turned on. So, reverse things if you can't make it work in those situations. However, what you're doing here is a 1:1 so it will work. #Router and internal network protection, with an internal server, LAN is considered friendly
/ip firewall filter
add chain=input action=drop connection-state=invalid comment="Disallow weird packets"
add chain=input action=accept connection-state=new in-interface=ether-LAN comment="Allow LAN access to the router itself"
add chain=input action=accept connection-state=established comment=" ^^ that originated from LAN"
add chain=input action=accept connection-state=related comment=" ^^ that originated from LAN"
add chain=input action=accept protocol=icmp comment="Allow ping ICMP from anywhere"
add chain=input action=drop comment="Disallow anything from anywhere on any interface"
add chain=forward action=drop connection-state=invalid comment="Disallow weird packets"
add chain=forward action=accept connection-state=new in-interface=ether-LAN comment="Allow LAN access to move through the router"
add chain=forward action=accept connection-state=established comment=" ^^ that originated from LAN"
add chain=forward action=accept connection-state=related comment=" ^^ that originated from LAN"
add chain=forward action=accept protocol=tcp dst-port=22 comment="Filter exception for port mapped server"
add chain=forward action=drop comment="Disallow anything from anywhere on any interface"
Port Forward (map) to an internal LAN server.
/ip firewall nat add chain=srcnat action=masquerade out-interface=ether-WAN comment="Turn on masquerading"
/ip firewall nat add chain=dstnat action=dst-nat protocol=tcp to-address=1.2.3.4 dst-port=22 to-port=22 comment="Create an incoming port map rule"
I am having the same issue with yours. did you manage to solve the issue?
myhot spot user are able to authenticate but they cannot access the internet.
ROUTER HAS NO SOFTWARE KEY
You have 11h52m to configure the router to be remotely accessible,
and to enter the key by pasting it in a Telnet window or in Winbox.
Turn off the device to stop the timer.
See www.mikrotik.com/key for more details.
Current installation "software ID": NGTX-GNXG
Please press "Enter" to continue!
[admin@MikroTik] >
[admin@MikroTik] >
[admin@MikroTik] >
[admin@MikroTik] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough log=no log-prefix=""
1 ;;; Turn on masquerading
chain=srcnat action=masquerade out-interface=WAN log=no log-prefix=""