Help with NAT Firewall Rule with Address List of Countries

RouterOS Beginner Basics
1

Hello,

I try to filter one of the servers HTTP access by source address list. I’ve used address list for RDP Whitelist IPs and it works. In this case I have 1 range and 2 IPs assigned to the whitelist.

ip firewall nat add action=dst-nat chain=dstnat dst-address=1.2.3.4 protocol=6 dst-port=3389 src-address-list=WHITELIST to-addresses=192.168.168.24

However, when i try to do the same for HTTP the sites don’t load. US Address List consists of almost 50,000 IP Ranges.

ip firewall nat add action=dst-nat chain=dstnat dst-address=1.2.3.4 protocol=6 dst-port=80 src-address-list=US to-addresses=192.168.168.24
2

Hi,
is 192.168.168.24 your web server ??

3

Yes

4

add action=dst-nat chain=dstnat dst-address=1.2.3.4 dst-port=80 protocol=tcp src-address-list=US to-addresses=192.168.168.24 to-ports=80

it should work unless you have other firewall rules or NAT rules , also make sure your web server is HTTP not HTTPS

5

I just have basic filter rules, to drop invalid, allow established and related, then drop everything else. The thing is this rule works if I remove the source address list. The moment I add the address list I loose Http connection to the sites. This server has multiple ips and I do use https but for the sake of the testing I choose ip with sites that use only port 80.