Mikrotik Dual WAN and DMZ and PPTP problem.

RouterOS Beginner Basics
1

Hi everybody, I finally got one of those pieces in my hand. Company I work for bought Mikrotik RB2011UiAS-2HnD model.

I never configure MT before (I always did CISCO) but tried to do it now. I managed to set up WiFi, dual WAN interfaces, NAT and DMZ. Also configured two WLANs one for internal use and other as HotSpot for guests. Also separate guest WLAN from internal pool without any issue. But I have two problems.

Network is consisted from 2 WAN links. One is ADSL and other is FiberOptic. ADSL is not here yet but I reserved interface WAN1 for it. And interface WAN2 is for Fiber. Link WAN1 should be primary for everything except for traffic I set in mangle rules and that traffic should go through WAN2 or DMZ

Problem 1: I can get online from inside and can forward port from outside as it should. BUT. I cannot get access from outside to configure router from winbox or telnet or ssh. I also set pptp vpn on WAN2 link but cannot access to it. I tried to ping port 1723 from outside but it is not open.

Problem 2: I have 15 public addresses 212.200.x.x from mu ISP (alongside with WAN2 fiber optic link) but when I connect server directly on DMZ interface and give to it public IP I can go to Internet but I cannot access from outside for example to web server on port 80 tcp. I tried with firewall rules but no luck. I will try different approach with NAT as described here but I think that here is something else problem.

I attached config here. Does anybody have any idea?
config.txt (8.19 KB)

2

I tried different approach but it is not working. I just don get it how to open required ports for DMZ. I created PPTP server behind NAT and it is working but still cannot create VPN server on router itself. It is driving me crazy. Must be something trivial but I just cannot see it.

3

I managed to make DMZ to work. It was service on server malfunctioned. Now I have only to setup VPN on device itself rather than to forward PPTP through NAT.

EDIT: Changed firewall rule and removed destination address of input chain and everything works fine. At friday I will get an ADSL link. Hope everything will work.