How to access External IP in LAN ?

RouterOS General
1

Hi
My Interface is as following:

[admin@MikroTik] > interface print
Flags: D - dynamic, X - disabled, R - running, S - slave

NAME TYPE MTU L2MTU MAX-L2MTU

0 ether1-PoE ether 1500 1598 4074
1 R ether2-local-master ether 1500 1598 4074
2 R ether3-local-slave ether 1500 1598 4074
3 R ether4-local-slave ether 1500 1598 4074
4 R ether5-WAN-GW ether 1500 1598 4074

Port4 is WAN port with assigned external IP
Port2 is LAN with 192.168.1.x
Port3 is LAN with 192.168.0.x

There is a webserver on 192.168.1.5, it is access from Port2 and also from Port3 with internal IP
But I cannot access it with external IP

I tried - http://wiki.mikrotik.com/wiki/Hairpin_NAT
but it does not work. It is for one internal port, I could not make it work on 2 LAN ports

2

You are getting the 2 definations of “ports” mixed up.

In the rule, the “port” is the TCP port of the server (like 80 for example). This has nothing to do with the physical network port (port 1, port 2, port 3, etc).

Your physical ports (2,3,4) are on a switch, and they will ALL work to access the server… unless you have an incorrect configuration elsewhere preventing it.

3

Please help me to find out the solution. Below are all rules I have(deleted from list inactive rules):

[admin@MikroTik] > ip firewall filter print
7 chain=input action=accept protocol=tcp dst-address=192.168.125.30 dst-port=225,22
8 chain=input action=accept protocol=tcp dst-address=192.168.125.30 in-interface=ether2-local-master dst-port=80
9 chain=forward action=accept protocol=tcp dst-address=192.168.125.3 dst-port=9980
10 chain=forward action=accept protocol=tcp dst-port=8443
11 chain=input action=accept protocol=tcp dst-address=192.168.125.30 dst-port=10050
12 chain=input action=accept protocol=tcp src-address=192.168.125.30 dst-address=192.168.125.3 dst-port=27644

[admin@MikroTik] > ip firewall nat print
3 ;;; Access rule to SSH for server 192.168.125.3
chain=dstnat action=dst-nat to-addresses=192.168.125.3 to-ports=22 protocol=tcp in-interface=ether5-WAN-GW dst-port=222
4 ;;; Access rule to SSH for server 192.168.125.30
chain=dstnat action=dst-nat to-addresses=192.168.125.30 to-ports=22 protocol=tcp in-interface=ether5-WAN-GW dst-port=225
7 ;;; NAT Ncell
chain=srcnat action=src-nat to-addresses=xxx.xxx.xxx.xxx protocol=tcp src-address=192.168.125.3 dst-port=7106
8 ;;; NAT Ncell
chain=srcnat action=src-nat to-addresses=xxx.xxx.xxx.xxx protocol=tcp src-address=192.168.125.30 dst-port=7106
9 ;;; NAT Ncell
chain=srcnat action=src-nat to-addresses=xxx.xxx.xxx.xxx protocol=tcp src-address=192.168.125.30 dst-port=8080