I have a webserver in IP Range 192.168.100.0/24 and I have a client in 192.168.0.0/24.
I can’t connect over my domain address to my webserver from inside my network, that’s why I would like to make a Hairpin NAT. I tried to do it after this tutorial: https://www.youtube.com/watch?v=_kw_bQyX-3U&feature=youtu.be but it doesn’t work. I entered as Src. Address 192.168.100.0/24 and as Dst. Address 192.168.0.0/24.
I have a Filter Rule that drops every contact between both nets (and this I would like to keep: block every traffic between these two networks). I would like to make it work this way: PC ↔ Internet ↔ Webserver. This worked before, but now I have got a static IP and it won’t work anymore…
4 rules? which do I need? The wiki only tells about one and the tutorial as well.
DNS: I’m using pi hole as a DNS for my Client, and 1.1.1.1 for my webserver. Should I modify my piHole?
Will this work even if I block all traffic between 192.168.100.0 and 192.168.0.0 with a firewall rule?
Overriding www.yoursite.com would be less complicated. Do it in pi-hole if possible. If not, you can catch DNS requests in the Mikrotik, repoint the domains to your Mikrotik’s DNS and override there.. You’d have to override yoursite.com and www.yoursite.com. You will need to allow port 80/443 to your webserver in your firewall between the two LANs.
For hairpin, I had to read that article a few times and in the end I implemented at a few places then I rolled it back as using DNS was so much easier. For the 4 rules, I meant 4 steps. You may have to follow it closely a few times to understand the 4 steps.
Hairpin NAT is only required when both client and server are in same subnet. You have two subnets => you don’t need hairpin NAT. You do not need to override hostname either, that’s useful intead of hairpin NAT to save packets trip to router and back. But if they are going through (I assume) same router anyway, it won’t make things easier.
No matter what you do, you will have to allow this traffic in firewall filter… in some way. What you need is (example for web):
Second rule must be before the one used to block traffic between the two subnets. It allows previously dstnatted packets, so connection from 192.168.0.x to forwarded to server 192.168.100.x will succeed, but direct connections from 192.168.0.x to 192.168.100.x will be still blocked by your original rule.
If you mean the srcnat rule with same src/dst-address=/ used with hairpin NAT, that’s not needed here. It’s needed when client thinks that it communicates with some external address, but server would see client’s real address from same subnet, would reply directly and that would not work, because client expects reply from that external address. But in this case, even if server sees client’s real address, the reply will still be sent to router, because the address is in another subnet. And it will work.
My guess is that it’s because firewall filter. We didn’t see the config, but if it unconditionally blocks traffic between two LANs, it can’t work no matter what’s done with NAT.
I tried to disable the filter rule which blocks the traffic between both networks, but this didn’t change anything. Still no access to my domain.
edit: If I add my domain and the IP of my reverse Proxy to the /etc/hosts file of my Win 10 computer AND if I disable the filter rules THEN it will work.
Now I know two things:
Okay so if this is all true, and not some sad sob story LOL, then shouldn’t the rule include a source address list for added security??
add chain=dstnat dst-address= protocol=tcp dst-port=80,443 action=dst-nat to-addresses=192.168.100.x
source-address-list=Internal_Access
This dst Nat is already running, otherwise I won’t have access from outside.
Here:
add action=dst-nat chain=dstnat comment=“HTTPS an reverse proxy” dst-address=XXX dst-port=80,443 in-interface=ether1
protocol=tcp to-addresses=192.168.100.110 to-ports=443
And you should probably read some more about setting up useful firewall, because now you only block selected traffic between local subnets, but everything else is wide open. If someone in your ISP’s network decided to connect to any of your 192.168.x.x devices, your routed would happily let them.
Next, I don’t think you want dst-port=80,443 and to-ports=443 in same dstnat rule, because it will send both port 80 and 443 to port 443. If you don’t forward outside port to different inside port, just leave to-ports blank.
And as was already pointed out, use only dst-address=XXX, not in-interface=ether1. I don’t know why people always use in-interface for port forwarding, it will bite them sooner or later.
Where is the problem?
And as I understand my firewall, it will block everything except 1194, 26070, 443 and 80, which will be forwarded to the specific servers?
and what does this one does exactly:
“add action=accept chain=forward connection-nat-state=dstnat” ?
