Hello!
I have a Mikrotik 2.9.51 router with 4 network interfaces: DMZ, PRIVATE, PUBLIC, ISP
I have set up a Hotspot server on PUBLIC with Radius authentication. Everything works just fine except of one thing. I can not access the webs which are in the DMZ zone. The real IP addresses of these webs are assigned to the ISP interface and a dst-nat is set up for each of those IP’s. When I try to access my webs from hotspot I get the mikrotik routeros administration page.
Any ideas???
Only conclusion, something wrong with dst-nat or src-nat. Did you src-nat from webs ip to ip assigned by isp?
My ip’s work like this:
ISP interface has a address 80.233.177.9
server in DMZ has address 10.20.254.61
dst nat: dst-addr:80.233.177.9 protocol:tcp port:80 → action dst-nat 10.20.254.61 protocol:tcp port:80
src-net: src-addr:10.20.254.61 → action src-nat 80.233.177.9
The interesting thing is that none of the packets get to the dst-nat section. I checked it (reset counters) They all go throught the Dynamic rulle added by hotspot and jump to hotspot chain. I tried to move the rule lover(after all dst-nat rules) but it didnt work!
From other interfaces like ISP and PRIVATE the DST-NAT works just fine. When I delete HOTSPOT on this interface and just enable DHCP on this interface everything works also fine. When I set up hotspot it doesnt work.
It looks like when hotspot sends a packet to the router on address 80.233.177.9 on port 80 it does’nt see my dst-nat rules, but I dont understand why!!!
Any more ideas!
Try to put DST-NAT rules to ‘pre-hotspot’ chain, however for your scenario, I recommend to use static DNS,
setup
ip dns static add name=www.myserver.com address=address_of_the_connected_to_the_Router
Thanks a 1’000’000
It worked!
Problem solved