Mikrotik CR326 Nat External acces to internal service

Paulska10 · August 5, 2026, 8:29am

Greetings,

I try to access on internal service (webservice) outside the network (external access) without success.

I add this NAT rules

add chain=dstnat dst-port=8010 protocol=tcp action=dst-nat to-addresses=192.168.51.250 to-ports=8010

But when i try to access with my external IP on same port, error (connection timed out).

I have a specific setup :

Internet -> Router A with DHCP on 192.168.1.X -> Mikrotik with DHCP on 192.168.51.X

All my device is on 192.168.51.X network, all works (access to Internet, access to 192.168.1.X network).

On my Router A, i have a NAT rules :

Wan port : 8010
Lan Port : 8100
Lan IP : Mikrotik IP on 192.168.1.X

I have this setup entry on Mikrotik (internal service is set on dhcp with static)

/interface bridge
add admin-mac=04:F4:1C:8C:E7:6F auto-mac=no comment=defconf name=bridge
/interface list
add name=WAN
add name=LAN
/ip pool
add name=dhcp ranges=192.168.51.10-192.168.51.254
/ip dhcp-server
add address-pool=dhcp interface=bridge name=dhcp1
/interface bridge port
add bridge=bridge comment=defconf disabled=yes interface=ether1
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=ether11
add bridge=bridge comment=defconf interface=ether12
add bridge=bridge comment=defconf interface=ether13
add bridge=bridge comment=defconf interface=ether14
add bridge=bridge comment=defconf interface=ether15
add bridge=bridge comment=defconf interface=ether16
add bridge=bridge comment=defconf interface=ether17
add bridge=bridge comment=defconf interface=ether18
add bridge=bridge comment=defconf interface=ether19
add bridge=bridge comment=defconf interface=ether20
add bridge=bridge comment=defconf interface=ether21
add bridge=bridge comment=defconf interface=ether22
add bridge=bridge comment=defconf interface=ether23
add bridge=bridge comment=defconf interface=ether24
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set accept-router-advertisements=yes
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.51.1/24 interface=bridge network=192.168.51.0
/ip dhcp-client
add interface=ether1 name=client1
/ip dhcp-server lease
add address=192.168.51.252 comment="Test External access" mac-address=
BC:24:11:FA:8D:E1 server=dhcp1
/ip dhcp-server network
add address=192.168.51.0/24 dns-server=192.168.51.251 domain=XXXXXX
gateway=192.168.51.1 netmask=24
/ip dns
set servers=::,::
/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input dst-address=127.0.0.1 in-interface=lo
src-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else" log=yes log-prefix=
drop_all_
add action=fasttrack-connection chain=forward connection-state=
established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=internet in-interface-list=LAN
out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=8010 protocol=tcp to-addresses=
192.168.51.252 to-ports=8010
/ip route
add disabled=yes dst-address=0.0.0.0/0 gateway=192.168.1.254
/system clock
set time-zone-name=Europe/Paris
/system logging
add comment=firewall topics=firewall
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN

I think a filter rules is missing or block but i try to disable each drop entry, no success.

Thanks for your help !

CGGXANNX · August 5, 2026, 5:57pm

Paulska10:

add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=internet in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"

With this content of your filter forward chain, traffic originating from the outside will not be permitted. The rule with the "drop all else" comment will drop them. Add a rule like this before that rule:

/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat out-interface-list=LAN

Also, the conditions for this DSTNAT rule are currently too broad:

you should add a dst-address-type=local restriction to it.

Paulska10 · August 5, 2026, 6:52pm

Thanks for your help,

I try by adding your firewall rules but same result, not works.

CGGXANNX · August 6, 2026, 10:28am

Could you please post the current output of /ip firewall export?

Also, this is very important: When you are doing the tests, are you really doing it from outside of your network (for example from a phone on LTE/5G only, not on your WiFi)? Or are you testing from a PC/phone within your LAN?

If doing the later, your config will not work as-it. You'll have to add additional configuration for Hairpin-NAT if you want to test from inside your network. Let me know if that's the case.

Paulska10 · August 6, 2026, 12:57pm

Hi CFFXANNX,

This is the output of /ip firewall export

/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked
add action=drop chain=input connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input dst-address=127.0.0.1 in-interface=lo src-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN
add action=accept chain=forward connection-nat-state=dstnat log-prefix=log_rules_homer out-interface-list=LAN
add action=drop chain=input comment="drop all else" log=yes log-prefix=drop_all_
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=accept chain=forward comment=internet in-interface-list=LAN out-interface-list=WAN
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address-list=local dst-port=8010 protocol=tcp to-addresses=192.168.51.252 to-ports=8010

Testing outside my network (with 5G)

rextended · August 6, 2026, 1:47pm

Add this:

/ip firewall nat
add action=src-nat chain=srcnat dst-address=192.168.51.252 to-addresses=192.168.51.1

Paulska10 · August 6, 2026, 1:49pm

Hi rextended,

With previous rules added on nat ?

add action=dst-nat chain=dstnat dst-address-list=local dst-port=8010 protocol=tcp to-addresses=192.168.51.252 to-ports=8010

Thanks for your help

rextended · August 6, 2026, 1:51pm

I don't understand, I just wrote "Add this", not move/remove/alter, etc.

rextended · August 6, 2026, 2:02pm

(wrong position, must be after add action=drop chain=forward connection-state=invalid )
Why make up convoluted rules when the predefined ones do the job?

`add chain=forward action=drop in-interface-list=WAN connection-nat-state=!dstnat'

CGGXANNX · August 6, 2026, 2:10pm

You've assigned the wrong property It's not dst-address-list=local but as I wrote above:

We don't have an address list named local created. Instead, dst-address-type=local means "the destination address of the packet matches one of the router own IP addresses, the addresses you see in the /ip address print output". In your case 192.168.51.1 will match, as well as the 192.168.1.X of that the Router A assigned to your MikroTik router.

You should clear (click - button) the current assigned Dst. Address List in WinBox, and go to the Extra tab and select this:

Paulska10 · August 6, 2026, 2:17pm

Wow Thanks !

And sorry for mistake

It's Ok (with correct nat rules)

Thanks CGGXANNX and rextended !

CGGXANNX · August 6, 2026, 2:19pm

Because OP follow @anav's school of firewall rules and has a "drop all else" on the forward chain at the end. So everything else must be explicitly allowed. OP only had one "allow from LAN to WAN", so we need one for DSTNAT too.

So I suggested "allow dst-nat to LAN" (instead of @anav's usual "allow dst-nat from WAN", in case OP wants to use the redirection from within LAN too).

Paulska10 · August 6, 2026, 2:22pm

Yes, rules comes to Beginner - Routing 2 DHCP / Network - #3 by anav (my previous post).

rextended · August 6, 2026, 2:24pm

Exactly,
you don't do anything so special that it would justify me having rules other than the predefined ones...
(which require fewer of them to do the same job better...)