Problem: I can’t map ports to the LocalNetwork through Mikrotik to 192.168.88.3 - LocalComp where started nginx(for test)
I mapped ports 80 & 8291 on Keenetik to Mikrotik IP : 192.168.1.103 - all works fine, I can connect to Mikrotik from Internet via WinBox
I mapped ports on Mikrotik with /ip firewall nat add chain=dstnat dst-port=80 action=dst-nat protocol=tcp to-address=192.168.88.3 to-port=80 – nothing work - I can’t open web page on LocalMachine from Internet
I have thought it’s because I don’t need nat but need forward packet to next node(192.168.88.3), or probably I need add rule to input chain, as Keenetik send packets to 192.168.1.103(to input Mikrotik)
I’ve turned off all drop rules in firewall, then have tried:
/ip firewall filter add chain=forward action=add-dst-to-address-list protocol=tcp dst-address=192.168.1.103 address-list=192.168.88.3 dst-port=80
not working. With input not working too.
Please hint me, which rules I must to add to reach from Internet LocalComp
Your dstnat rule is incomplete, only two conditions are protocol=tcp dst-port=80. So if something local LocalNetwork tries to open some web page, it’s also connection to tcp port 80 and will be forwarded to 192.168.88.3. So you need to add dst-address=192.168.1.103 as another condition.
As for forwarding to internal server, with default firewall and dstnat rule it should just work. If not, you need to allow it through firewall. Simple way for all forwarded ports is:
Another way, if you don’t want NAT on Mikrotik, you can add static route to its subnet (destination 192.168.88.0/24, gateway 192.168.1.103) and forward ports to 192.168.88.3 directly from main router.
Thanks Sob, I made second(route to 192.168.88.0) and very strange, ping pass through(from keenetic) but packets to 80 port don’t
I’ve tried this: chain=dstnat action=dst-nat to-addresses=192.168.88.3 to-ports=80 protocol=tcp dst-address=192.168.1.103 dst-port=80 log=no log-prefix=“” don’t work
Anyway, thank you
If you go with the second option, then there isn’t (shouldn’t be) any NAT, neither dstnat rules, nor anything in srcnat chain (src-nat/masquerade). But depending on your firewall filters, you may need to allow connections using: