Help with NAT

RouterOS Beginner Basics
1

Hi,

I have been trying to find a solution using “search” but without any luck…
Can someone please help me with the following problem?

I need PC1, PC2 and PC3 to access PC4 (UDP port 1821)
Routing tables are set and working OK in Mikrotik Routerboard.
Port Forward on the DSL Router is set to forward port 1821 to ip 10.0.1.3
PC3 is accessing PC4 without any problem.

PC1 and PC2 obviously cannot communicate with PC4.
I need a rule to send UPD port 1821 from PC1 and PC2 to PC4.

I am currently using the following rules with no success:

  1. dstnat, Dst.Address 10.0.1.1, protocol 17 (udp), Src port 1821, ACTION dstnat, to address 10.0.2.1, to ports 1821.
  2. srcnat, protocol 17 (udp), Src port 1821, ACTION masquerade.

When I enable these rules, only PC1 OR PC2 (not both) can access PC4. PC3 has NO ACCESS as well.
When I disable these rules PC 3 has access to PC4 but (obviously) PC1 and PC2 cannot access PC4.

Can someone help me so that all three PCs (PC1, PC2 and PC3) can access PC4?

John.
mikrotik.jpg

2

I’m not sure I understand your setup, shouldn’t either the wireless interface be on a 10.0.2.X address or the PC4 be on a 10.0.1.X address (if you’ve bridged the wireless)

Further on, if the PC4 is on a different address range, does the DSL modem have a router to tell it where the 10.0.2.X range is found (in this case via the mikrotik.. once again me assuming)

3

Yes you are correct. I updated the setup.
From inside my lan I have no problem accessing PC4.

My default router is the routerboard with IP 10.0.1.3
The DSL model has no clue where the 10.0.2.X is. This is why I forward port 1821 to the routerboard. The routerboard knows where the 10.0.2.X range is found.
This is why i need the routerboard to accept incoming request from the DSL modem and forward them to 10.0.2.1 (pc4)

Thanks

4

Ok then, your rule is incorrect for how you have this setup.

If you are forwarding port 1821 to 10.0.1.3 then this

  1. dstnat, Dst.Address 10.0.1.1, protocol 17 (udp), Src port 1821, ACTION dstnat, to address 10.0.2.1, to ports 1821.

Should instead be

  1. dstnat, Dst.Address > 10.0.1.3> , protocol 17 (udp), Src port 1821, ACTION dstnat, to address 10.0.2.1, to ports 1821.

because 10.0.1.3 is the address that the packets should be hitting (because they’ve already been forwarded by the dsl router to that IP address.

5

Thank you,
I will try it and let you know

6

Ok, update,

I changed the rule to: dstnat, Dst.Address 10.0.1.3, protocol 17 (udp), Src port 1821, ACTION dstnat, to address 10.0.2.1, to ports 1821.

PC1 gained accessed to PC4. Connection is now listed as “assured” in the “connections list”
PC2 still has no access to PC4. Connection appears from PC2 to routerboard (10.0.1.3) on the connection list (connections TAB) but is listed as “unreplied”

If I switch off PC1, then PC2 gains access to PC4, but then PC1 cannot reconnect to PC4.

Now PC3 has NO access as well. If I remove the rule PC3 gains access…

Why PC1 and PC2 cannot BOTH gain access to PC4?

thanks

7

Ok, firstly: PC3, what address do you try to access when you connect from PC3?
Are you trying 10.0.1.3:1821?

PC2: Is it located on the same internet connection as PC1 or seperate. Im assuming you’ve checked to make sure firewall etc isn’t blocking it?

8

Hi,

PC3 is inside my LAN. From PC3, when i try to access PC4 (10.0.2.1:1821) I have no problem at all as long as NAT rules are disabled.

PC1 and PC2 are on different internet connection. When NAT rules are enabled, PC1 OR PC2 can access PC4 (the first PC that accesses PC4 establishes connection. The other has no access.) If PC1 establishes connection to PC4 then PC2 cannot connect. If PC1 powers off then PC2 establishes connection to PC4 but PC1 cannot reconnect as long as PC2 is still active.

The target is to have all three PCs (PC1 and PC2 from the internet and PC3 from my LAN) access PC4.

Thanks!

9

May I enquire as to what the application is that is running on 1821, could it be that it won’t accept more than one connection at a time?

10

The application has to do with image generation. It can accept multiple connections. If i move PC1 and PC2 inside my LAN and apply no rules, then all three PCs can access PC4 simultaneously.

Thanks.