Hello,
I am developing client-server application; the question is how to properly forward traffic (TCP/UDP) to and from server.
I have created a NAT rule as follows:
Chain: dstnat
Protocol: 6 (tcp)
Dst. Port: 4296 (my server on local machine is listening on that port)
Action: dst-nat
To Addresses: 192.168.88.253 (this is server’s address in my LAN).
To test, I launch my client app on mobile (via cellular network, not from local Wi-Fi, to make the test more clean) - and on Rate Graph panel I see bytes incoming. The question is, which rule do I need to add, to make my server able to respond back to Internet? Thanks!
For start, you should fix dstnat rule, because this one takes all connections to specified port, incoming and outgoing ones. Add either dst-address= if you have static one or dst-address-type=local if it’s dynamic.
After that, connection must be allowed through firewall filter, and it depends on what you have there now. Factory default firewall already handles it, but if you have something else, you may need:
Thanks Sob and anav!
Let’s elaborate this a little bit more for old fossils like me. If I understand the whole mechanics right, now it looks like this:
1.Mobile (or whatever Internet) client sends packet to WAN.
2.DST-NAT rule substitutes DST with LAN-addressed machine.
3.Server responds with DST copied from arrived packet’s SRC.
4.Now my task is to write a rule that substitutes wan.ip as SRC?
This hAP’s web interface has so many options when you design a rule so I’m a little bit lost(
(wan.ip == static.ip in this context)
No, this last part is automatic. Router tracks all connections, remembers all their original and new sources and destinations, and recognizes packets that belong together as one connection. You can see this data in IP->Firewall->Connections (WegFig doesn’t seem to show everything at once, I have to click on each item; WinBox allows to show all columns). So if there was packet from mobile.ip to static.ip and dstnat changed destination to lan.ip, then when response comes from lan.ip to mobile.ip, connection tracking recognizes that it belongs to that connection, and automatically changes source from lan.ip to static.ip.
To add to what @sob said,
Indeed the connection tracking Table keeps track of all the connections that are taking place to the Router.
So it knows if a packet was Source Nated, Dst Nated etc…
In that example, the router knows the packet was dst nated and it will un-nat that connection. The same happens in the case of src nated packets.
I’m sure it’s not that. When you’re testing it, counters for this dstnat rule increase, right? You can add some logging rules to see if server is responding at all:
