I needed to do the same thing. The object I needed to connect to behind the hotspot was another router, running Ikarus OS, which needed an odd port to be open.
To get to port 80:
The easy part is:
ip firewall add chain=dstnat dst-address=1.2.3.5 dst-port=80 action=dst-nat to-address=192.168.1.10 to-port=80
After creating this entry MOVE IT TO THE TOP OF THE CHAIN. It has to appear before the other rules that will otherwise send your packets to the hotspot servlet.
(Pls forgive the syntax errors and the misspelled keywords, I usually use winbox but I can’t get to it now).
The above will get your packets to your server behind the hotspot. Unfortunately, the returning packets will get eaten by the incoming hotspot rules.
To get around this, there is probably some clever use of other nat rules. I tried many
things and none of them worked. Finally, I did the following:
Try to login to your server from the wan side. It won’t answer, but it should now show
up in the list of hosts in the hotspot page. Tell the hotspot server to bind this
address statically. With winbox, a window will open when you click static binding, and you should select the pulldown option of ‘bypass’. This will allow your server to bypass
logging in to the hotspot.
You will now be able to access the server from the public side of your router.
The above will work only if your server is in the IP address space of the dhcp server for the hotspot. If, like I did, you want the server to be outside that range, another complication arises. The hotspot will map the server’s real address to another address within its range. This mapped address is labeled ‘to-address’ in the hotspot host list. If that is your situation, then the above instructions for the dstnat chain should use the mapped address that the hotspot uses as the dst-nat to-address, not the servers actual IP address.
I don’t know what process on the router is doing this mapping. There is no nat rule for it, so I’m guessing the hotspot servlet somehow gets access to the routing engine.
If anyone reading this understands how this is being done, and also why it needs to be done, please let us know. Since the mapping is always to an address in the dhcp space, you wind up wasting two address on the hotspot lan to access one server. I guess it makes sense to just assign the server (or servers) to addresses in the dhcp space. Once they are bound, the dhcp server won’t serve them up to regular users, so no harm in that area.
I have a second server behind my firewall, and I can’t get it to show up in the hotspot hosts list, so I can’t set its bypass flag. I therefore can’t access it from the public side. If anyone has a better way to do this please let us know. Perhaps a better explanation of how the hotspot function works would give us the tools to figure this out for ourselves.
