Hi mikrotik community, I have now few days hard experience on mikrotik and I can say I’m amased with routerOS. I have read all the possible tutorials and solutions + this forum and I got stuck.
Anyway here is my SETUP and curent progress (I hope I can get some lead/advice and help since i’m stuck).
What is my problem? I have a HIGH latency internet without a public IP and thus I need a L2TP VPN for my IP Cameras to get to them remotely.
My PLAN?
Mikrotik (L2TP client) > L2TP SERVER > INTERNET
What I managed so far?
I got a connection to the L2TP Linux server with mikrotik. Now my whole LAN IP range goes over the VPN and gets the VPN server IP. Great! Also I can get access to the mikrotik router over the server IP!
SETUP:
VPN SERVER IP: 85.111.222.333
Mikrotik WAN: connected to another router which is connected to my ISP and got IP 192.168.1.123/24 later I connect it directly to a high latency internet connection but here i only try to set it UP
Mikrotik VPN IP: 10.1.2.3
Mikrotik LAN IP: 192.168.88.1
Lets go on..
I managed to access MT(mikrotik) WEBfig remotely with 85.111.222.333:PORT by NAT-ing firewall rules in the VPN Linux server. This means VPN works fine and I want it like that!
What I want now is when I connect a device to my MT in this example I have an IP CAMERA which got IP 192.168.88.244 from mikrotik. The camera has a GUI on 192.168.88.244:900 and I want to access that guy by NATing it in the linux server! But it won’t work like the mikrotik WEBfig on port 80. I can access the webfig by going to 10.1.2.3:200 (the VPN IP, i put port 200 on linux VPN server side) but I can’t get port 900 OUT. I tryed all possible rules and solutions but i am stuck elsewhere!
Here are some codes so far:
[admin@MikroTik] /ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 X chain=dstnat action=dst-nat to-addresses=192.168.88.244 to-ports=0-65535
protocol=tcp dst-address=10.1.2.3
1 X chain=srcnat action=src-nat to-addresses=10.1.2.3 to-ports=0-65535
protocol=tcp src-address=192.168.88.244
2 X chain=dstnat action=dst-nat to-addresses=192.168.88.244 to-ports=900
protocol=tcp dst-address=10.1.2.3 routing-mark=l2tp
in-interface=l2tp-out1 dst-port=900
3 X chain=dstnat action=dst-nat to-addresses=192.168.88.244 to-ports=900
protocol=tcp in-interface=l2tp-out1 dst-port=900
4 X chain=dstnat action=dst-nat to-addresses=192.168.88.244 to-ports=900
protocol=tcp dst-port=900
5 X chain=srcnat action=src-nat to-addresses=10.1.2.3
src-address=192.168.88.244 out-interface=ether1-gateway
6 X chain=dstnat action=dst-nat to-addresses=192.168.88.244
dst-address=10.1.2.3 in-interface=ether4-slave-local
7 ;;; default configuration
chain=srcnat action=masquerade to-addresses=0.0.0.0
out-interface=ether1-gateway
8 chain=srcnat action=masquerade out-interface=l2tp-out1
9 chain=srcnat action=accept
10 chain=dstnat action=accept
[admin@MikroTik] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; default configuration
chain=input action=accept protocol=icmp
1 ;;; default configuration
chain=input action=accept connection-state=established
2 ;;; default configuration
chain=input action=accept connection-state=related
3 ;;; default configuration
chain=input action=drop in-interface=ether1-gateway
4 ;;; default configuration
chain=forward action=accept connection-state=established
5 ;;; default configuration
chain=forward action=accept connection-state=related
6 ;;; default configuration
chain=forward action=drop connection-state=invalid
In short:
I want 192.168.88.244:900 = 10.1.2.3:900 (IP CAMERA connected by cable on ethernet 4)
Right now WORKS! 192.168.88.1:80 = 10.1.2.3:80
10.1.2.1 IP range is the L2TP IP given by the linux VPN server!
What to do to get port 900 OUT over l2tp-out1 IP 10.1.2.3? standard ways don’t work..
