How do I forward a port ?

RouterOS General
1

Hello everyone this is my first post.
I am new to this Mikrotik RouterOS but have been learning a lot
about this from reading through this forum and the .pdf manual.
So i have figured out how to setup my router and it works great
and i have applied the example rules mentioned in the manual..

/ ip firewall filter
add chain=input connection-state=invalid action=drop \
comment="Drop Invalid connections"
add chain=input connection-state=established action=accept \
comment="Allow Established connections"
add chain=input protocol=udp action=accept \
comment="Allow UDP"
add chain=input protocol=icmp action=accept \
comment="Allow ICMP"
add chain=input src-address=192.168.0.0/24 action=accept \
comment="Allow access to router from known network"
add chain=input action=drop comment="Drop anything else"

What my question is, i have been searching this forum trying
to find out how i would add a Filter Rule that will forward a port
to my PC so that my Bit-Torrent client “BitComet” is connectable.
I seen a few posts where people were trying to stop / throttle BT data
but could not see any examples on how i would do this.
I use to log into my Dlink DI-604 router and forward ports on that
so im trying to find out how to do something similar on RouterOS.

So can anyone kindly show me an example rule ?
I think im not specifying enough data in my rule for it to work.
Well it would be great if someone could help me and thanks for reading my post.

2

This is done in the DST-NAT chain of the firewall..

/ip firewall nat

add chain=dstnat dst-port=<bittorent_port> action=dst-nat to-addresses=<private_ip> to-ports=<private_port>

That’s what the DST-NAT rule would look like.

oops yeah sorry forgot the “protocol=tcp” :blush:

3

hey thanks for your reply..

i have been experimenting with the sample rule you posted
but unfortunatly its not working and killing my connection..

im using 2 ethernet cards, one gets an ip from my ISP
by the dhcp-client i have started on ether1 (public)
and ether2 (private) has a dhcp-server handing ip’s out to my Lan clients.
I have a few rack mount switches plugged into ether2
and all this works well and i am using Nat Masquerade.

/ip firewall nat add chain=srcnat action=masquerade out-interface=ether1

as soon as i add the following the internet is not accessible.
and when i remove it everything is fine again.

/ip firewall nat

add chain=dstnat dst-port=8181 action=dst-nat to-addresses=192.168.0.254 to-ports=8181

note: 192.168.0.254 is my IP for my PC on the internal Lan.

so im kinda confused did i do something worng with my rule ?
or is that rule example provided not good for use with Nat Masquerade ?

4

You’re not specifying a protocol in your rule.

4 ;;; Incoming BitTorrent connections
chain=dstnat in-interface=Internet protocol=tcp dst-port=6881-6889
action=dst-nat to-addresses=192.168.1.2 to-ports=6881-6889

Regards

Andrew

5

Bingo thats the one :smiley:
works great now. Thanks for providing an example too
that was the last task/feature i use to do on a dlink router
that i was trying to replicate on the RouterOS.
Im liking this RouterOS.. ive never seen anything like this till recently.
thanks again for the help guys.

6

Hi to all

Im new on this furum the same as xpmule,ive just configured my second Mikrotik RouterOS working well.but stilll have a slight problem simalar to xpmule.I need to allow yahoo messinger and camfrog to pass though the router for my clients. Can i deactivate the firewall in some way?? using a code without too much comprimise to security??

so could someone help with a code i could use??

Thanks anyone?

7

Hi everyone! I tried doing port farwarding long time ago, not with the best results. I tried forwarding all SMTP and POP3 (25 and 110) traffic to my mail server, so, now matter what SMTP or POP3 server the client specify, the traffic will allways end up at my mail server. The POP3 I don’t care about, as some of my clients use other ISP’s for mail too, but for SMTP I would really like to make use of my mail server. We tried, but never really completed the task, to configure a Fedora server, load all domains we can think of, which our clients might use, and create a static dns entry on the MT so that all such SMTP servers will resolve to our SMTP server. Has anyone got this to work? What is best, port filtering or static dns?

G

8

I needed port 80 to forward to a SIP device on my privet network so that shop VoIP guy could get to it. All I did was open terminal and type this in
ip firewall nat then I hit the enter key
It returned this. ip firewall nat>
Then I typed this all in one line.
add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80 action=dst-nat to-addresses=10.1.1.190 to-ports=80 And hit enter again.

you can copy and paste it in note pad so that you can edit it. Also you need to make sure it does not word wrap.

Some times the GUI complicates things with all the tabs,drop down menus and fill in the blanks. But don’t take it the wrong way, 90% of the work I do is in the GUI.

9

It would be nice to have a DMZ button and or a simple interface like Linksys. But I sure someone would tell you that if you need that then buy a Linksys. LOL