My network server ------------------------- router --------------------------- client
server web: 192.168.1.11
routeur: 192.168.1.1 and WAN 192.168.0.2
I want to forward port 443. It does not work! I tested a lot of things!!
And does that “box” with real public address forward port 443 to 192.168.0.2? I assume you want it to work from outside, i.e. allow anyone to connect to your web server, right? If so, they will be connecting to your public address.
If you had only one network (everything in 192.168.0.x range), you’d need to configure “box” to forward port 443 to some 192.168.0.x (server address).
If you have another router and second network (which currently puts you behind double NAT, but it works too), you need to do the same thing twice, first set up “box” to forward port 443 from public address to 192.168.0.2 (this is what I’m asking about) and then set up router to forward port 443 from 192.168.0.2 to 192.168.1.11 (you already have that).
If you have both set correctly, then it also depends on where do you test if from. It might work from outside, but fail if tested from other device in internal network. That would be the problem described here.
Where 1.2.3.4 is example public adddress. I assume that when a packet comes to 192.168.0.2:443, it gets correctly forwarded to 192.168.1.11:433. But it can happen only when it’s first forwarded from 1.2.3.4:443 to 192.168.0.2:443. Is the “box” configured this way?
Your filter is using the wrong chain in the firewall - your rules to allow the server’s IP are all in the input chain.
The input chain is for talking to the Mikrotik itself (regardless of interface).
The FORWARD chain matches packets which flow THROUGH the router.
Many other products have a design where input means “as you receive a packet on an interface”
This is not the case with ROS (which is based on Linux netfilters - a.k.a. iptables).
Furthermore, the forward filter chain is called after the dstnat happens, so make sure the dst-address=x.x.x.x matches the private IP of the server, and not the public IP of the router.
Lastly, your dstnat rule might need to get tweaked just a touch - add the criteria in-interface=WAN (replace WAN with the actual wan interface name) or else you’re going to block your LAN’s own outgoing https connections.
There is also an issue with the filters. You want accept only traffic with src-port 443 and dst-port 443, which is wrong.
The originating port of an https connection is NOT 443, but some randomly chosen high number port, only the destination is 443. The same goes for most of the connections, so you need to match only the dst-port.
