http server behind mikrotik router won't accept connection

RouterOS General
1

Ok. so I have tried and tried to host a webserver behind my router, to provide webpages externally,but cannot get this to work.
I have added the following rule in NAT

 3   ;;; Redirect http connections to SPW-02
     chain=dstnat action=dst-nat to-addresses=192.168.88.5 to-ports=80 
     protocol=tcp in-interface=Telefonica1 dst-port=80

when someone tries to access my webserver externally I see the packets increasing, but always comes back with no response.

My webserver is on the general hotspot port and uses dhcp from the same pool, but the specific server is set to bypass the hotspot so has full access to the internet.

I have also tried to connect my webserver to my internet facing router via VPN and changing the nat rule to re-direct to the new assigned IP address.


everytime no connection can be made. can anyone spot any obvisous mistakes.

my server notes requests but cant provide web-pages externally. I have checked my web server and everything is fine.

Thanks for any ideas.

2

This would be significantly easier if you moved the server outside of the Hotspot. If you can’t do that, post more of your configuration (hotspot and firewall at least).

3

Its going to be difficult to move the webserver off the phisical hotspot port as it’s remotely connected to the router and the access point its connected to is shared by hotspot users.
this is why i tried using a vpn to connect to the router, but maybe there was further config i missed.

my config is as follows:
NAT

add action=dst-nat chain=dstnat comment="Redirect http connections to SPW-02" \
    disabled=no dst-port=80 in-interface=Telefonica2 protocol=tcp \
    to-addresses=192.168.88.10 to-ports=80
add action=dst-nat chain=dstnat comment="Redirect http connections to SPW-02" \
    disabled=no dst-port=80 in-interface=Telefonica1 protocol=tcp \
    to-addresses=192.168.88.10 to-ports=80
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="" disabled=no out-interface=\
    Telefonica1 src-address=192.168.88.0/24
add action=masquerade chain=srcnat comment="" disabled=no out-interface=\
    Telefonica2 src-address=192.168.88.0/24

Mangle

add action=mark-connection chain=input comment=\
    "Mark new inbound connection Telefonica1" connection-state=new disabled=\
    no in-interface=Telefonica1 new-connection-mark=Telefonica1 passthrough=\
    yes
add action=mark-connection chain=input comment=\
    "Mark new inbound connection Telefonica2" connection-state=new disabled=\
    no in-interface=Telefonica2 new-connection-mark=Telefonica2 passthrough=\
    yes
add action=mark-routing chain=output comment=\
    "Mark new inbound route Telefonica1" connection-mark=Telefonica1 \
    connection-state=new disabled=no new-routing-mark=Telefonica1 \
    passthrough=no
add action=mark-routing chain=output comment=\
    "Mark new inbound route Telefonica2" connection-mark=Telefonica2 \
    connection-state=new disabled=no new-routing-mark=Telefonica2 \
    passthrough=no
add action=mark-connection chain=prerouting comment=\
    "Mark new established connection Telefonica1" connection-state=\
    established disabled=no in-interface=Telefonica1 new-connection-mark=\
    Telefonica1 passthrough=yes
add action=mark-connection chain=prerouting comment=\
    "Mark new established connection Telefonica2" connection-state=\
    established disabled=no in-interface=Telefonica2 new-connection-mark=\
    Telefonica2 passthrough=yes
add action=mark-routing chain=output comment=\
    "Mark new established route Telefonica1" connection-mark=Telefonica1 \
    connection-state=established disabled=no new-routing-mark=Telefonica1 \
    passthrough=no
add action=mark-routing chain=output comment=\
    "Mark new established route Telefonica2" connection-mark=Telefonica2 \
    connection-state=established disabled=no new-routing-mark=Telefonica2 \
    passthrough=no
add action=mark-connection chain=prerouting comment="" disabled=no \
    dst-address-type=!local in-interface=ether9 new-connection-mark=\
    Telefonica1_pcc_conn passthrough=yes per-connection-classifier=\
    both-addresses:2/0
add action=mark-connection chain=prerouting comment="" disabled=no \
    dst-address-type=!local in-interface=ether9 new-connection-mark=\
    Telefonica2_pcc_conn passthrough=yes per-connection-classifier=\
    both-addresses:2/1
add action=mark-routing chain=prerouting comment="" connection-mark=\
    Telefonica1_pcc_conn disabled=no in-interface=ether9 new-routing-mark=\
    Telefonica1 passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=\
    Telefonica2_pcc_conn disabled=no in-interface=ether9 new-routing-mark=\
    Telefonica2 passthrough=yes
add action=mark-connection chain=forward comment=sip_connn connection-type=\
    sip disabled=no new-connection-mark=sip_conn passthrough=yes
add action=mark-packet chain=forward comment="" connection-mark=sip_conn \
    disabled=no new-packet-mark=sip passthrough=no
add action=mark-connection chain=forward comment="" disabled=yes \
    new-connection-mark=p2p_conn p2p=all-p2p passthrough=yes
add action=mark-packet chain=forward comment="" connection-mark=p2p_conn \
    disabled=yes new-packet-mark=p2p passthrough=yes
add action=mark-routing chain=output comment="" disabled=yes dst-address=\
    !192.168.88.0/24 new-routing-mark=Telefonica1 passthrough=no \
    per-connection-classifier=both-addresses:2/0
add action=mark-routing chain=output comment="" disabled=yes dst-address=\
    !192.168.88.0/24 new-routing-mark=Telefonica2 passthrough=no \
    per-connection-classifier=both-addresses:2/1

Andy Idea’s Welcome.

Thanks

4

Try this mangle set instead:

/ip firewall mangle
add action=mark-connection chain=input connection-state=new disabled=no in-interface=Telefonica1 new-connection-mark=Telefonica1 
add action=mark-connection chain=input connection-state=new disabled=no in-interface=Telefonica2 new-connection-mark=Telefonica2 

add action=mark-routing chain=output connection-mark=Telefonica1 new-routing-mark=Telefonica1 
add action=mark-routing chain=output connection-mark=Telefonica2 new-routing-mark=Telefonica2 

add action=mark-connection chain=forward in-interface=Telefonica1 connection-state=new new-connection-mark=Telefonica1 passthrough=yes
add action=mark-connection chain=forward in-interface=Telefonica2 connection-state=new new-connection-mark=Telefonica2 passthrough=yes

add action=accept chain=prerouting dst-address=1.1.1.1/24 in-interface=ether9
add action=accept chain=prerouting dst-address=2.2.2.2/24 in-interface=ether9
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=ether9 hotspot=auth connection-mark=no-mark new-connection-mark=Telefonica1 passthrough=yes per-connection-classifier=both-addresses:2/0
add action=mark-connection chain=prerouting dst-address-type=!local in-interface=ether9 hotspot=auth connection-mark=no-mark new-connection-mark=Telefonica2 passthrough=yes per-connection-classifier=both-addresses:2/1
add action=mark-routing chain=prerouting connection-mark=Telefonica1 in-interface=ether9 new-routing-mark=Telefonica1 
add action=mark-routing chain=prerouting connection-mark=Telefonica2 in-interface=ether9 new-routing-mark=Telefonica2

It requires 4.x

5

Thanks for the code, and thanks for editing the code for me, but can u explain the above two lines? as i’m not quite sure what they mean and if there ok as they are?
will this improve my webserver issue?
whats the primary difference in the mangle edit?


thanks

6

Sorry I forgot to annotate those lines. Replace the dst-address in those with the networks on Telefonica1 and Telefonica2 respectively.

The mangle rules I posted account for incoming connections that are dst-nat’d and make sure that the PCC rules in prerouting don’t send replies to the requests out the wrong WAN interface, which would account for the rules counting packets and the web server seeing the request but the client being unable to load the page.

Example: You’d have a request from an external client coming in Telefonica2. The rules count packets and the web server replies. But the reply from the webserver gets assigned Telefonica1 in the prerouting PCC rules and goes out the wrong WAN interface, and is now carrying the public IP of Telefonica1 due to NAT. The client gets the reply but discards it because it never asked that IP for the web page.

7

would it matter if both telefonica connections have the same gateway and dynamacally assigned addresses?
he Network/Gateway for the telefonica connections is always 192.168.153.1 and the ip address are two external addresses.

Sorry for all the questions…

8

ok. so I adjusted the mangle to the new suggested version, upgraded my router to 4.2 and still no success.

I’ve tried completly removing the mangle and only enabling one interface, still as soon as I enable to dst-nat to redirect to my internal IP where the webserver is hosted I get an error from internet-side clients saying unable to connect.

So does this mean it’s an issue with hosting my webserver on the same port as my hotspot? can this be bypassed and corrected? or is the only way to shift my http server off the hotspot and assign it to a new port?

Thanks!

9

Shouldn’t be, but try moving the webserver to port 81 and forwarding that port instead.

Have you also ruled out that your provider is simply blocking port 80 inbound? If you move the web server directly onto a provider circuit, can you reach it then?

10

You have made a common mistake. Don’t change the default setting “to-ports=0-65535”, leave it as it is.

11

Thanks THG, i’ll give that a try in the morning. Can you explain the reason behind leaving the ports as 0-65535 and not specifing 80?
Its just so I understand a little more, and hopefully others might learn, rather than just correcting it. thanks

12

Most of the connections made in TCP/IP follow a standard form. The client machine picks a random port between 1024 and 65535 (known as an “ephemeral” port), the packets are then sent to the server with a fixed known port that is below 1024. The client then send a port command to inform the server to use the ephemeral port as the destination to send data.

In your case the inbound packet will be directed to the Web server and have a destination to TCP port 80. The client source port will be some random port between 1024 and 65535.

I hope that will clarify why the reply destination port cannot be fixed to port 80.