How to reach RouterOs (web or Winbox) via my static ip address from outside network

RouterOS General
21

You didn’t just add everything from that PCC article, did you? I hoped it was clear that I meant it as a learning material, to understand what you need to do about connection and route marking. In other words, I was lazy to write full explanation myself (Van9018 did it few posts later) and that article has nice explanation of what’s happening.

If you don’t want load balancing, remove the two rules with per-connection-classifier option. For the rest, this:

add action=mark-connection chain=output connection-mark=swift_conn new-connection-mark=to_swift passthrough=yes

should be:

add action=mark-routing chain=output connection-mark=swift_conn new-routing-mark=to-swift passthrough=yes

And you also need to add:

/ip route
add check-gateway=ping distance=1 gateway=192.168.1.1

And to avoid all possibilities that these connection marks could conflict with your torrent connection marks, you should add connection-mark=no-mark option to your torrent marking rules (those with action=mark-connection).

And about remote access, you have to open some port (VPN should be better than bare WinBox), otherwise you won’t be able to connect.

22

Yes, that is true, but along with the VPN port you need to do something with the winbox port if you want to use be able to log remotely through winbox on a client. Which was a bit strange for me as when the client is connected to the VPN it is able to ping the router with it’s local address but it’s unable to log in through winbox on the client side. With opened winbox port it’s possible but It doesn’t seems to be secure enough. I even had the crazy idea to use port knocking with VPN to allow only addresses on the list to be able to connect to the VPN server.

23

I get it. You don’t need to open WinBox port from everywhere, you can do it only for connections from VPN, e.g. with in-interface=.

24

thanks Sob. it worked

25

Yes, that makes sense. Don’t know how I missed it. I\ll definitely try it. Thank you.