Multi-WAN dynamic IP port forwarding

RouterOS General
1

hi all
Port forwarding only works in Single-line??
I use 5-line load balancing, and sometimes find the port forwarding is not working properly(download software, sometimes the red light on)
Please tell me how to set up is correct, or ignore the red light?
Thanks

/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out1
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out2
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out3
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out4
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out5
add action=dst-nat chain=dstnat disabled=no dst-port=9364-9366 protocol=tcp \
    to-addresses=192.168.13.19 to-ports=9364-9366
add action=dst-nat chain=dstnat disabled=no dst-port=9364-9366 protocol=udp \
    to-addresses=192.168.13.19 to-ports=9364-9366
add action=dst-nat chain=dstnat disabled=no dst-port=23920 protocol=tcp \
    to-addresses=192.168.13.19 to-ports=23920
add action=dst-nat chain=dstnat disabled=no dst-port=23920 protocol=udp \
    to-addresses=192.168.13.19 to-ports=23920

捕获.PNG

2

That setup is correct, though you should add ‘dst-address-type=local’ to those rules.

3

Thank you fewi, I added

/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out1
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out2
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out3
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out4
add action=masquerade chain=srcnat disabled=no out-interface=pppoe-out5
add action=dst-nat chain=dstnat disabled=no dst-address-type=local dst-port=\
    9364-9366 protocol=tcp to-addresses=192.168.13.19 to-ports=9364-9366
add action=dst-nat chain=dstnat disabled=no dst-address-type=local dst-port=\
    9364-9366 protocol=udp to-addresses=192.168.13.19 to-ports=9364-9366
add action=dst-nat chain=dstnat disabled=no dst-address-type=local dst-port=\
    23920 protocol=tcp to-addresses=192.168.13.19 to-ports=23920
add action=dst-nat chain=dstnat disabled=no dst-address-type=local dst-port=\
    23920 protocol=udp to-addresses=192.168.13.19 to-ports=23920
4

@fewi
when you have time
1.Can you tell me why add ‘dst-address-type=local’ ,because of security reasons?
2.In addition, about load balancing, I would like to ask some questions,Hope you give me some guidance.

add action=mark-connection chain=input disabled=no in-interface=pppoe-out1 \
    new-connection-mark=pppoe-out1_conn passthrough=yes

add action=mark-routing chain=output connection-mark=pppoe-out1_conn \
    disabled=no new-routing-mark=to_pppoe-out1 passthrough=yes

add action=mark-connection chain=prerouting disabled=no dst-address-type=\
    !local in-interface=LAN-1 new-connection-mark=pppoe-out1_conn \
    passthrough=yes per-connection-classifier=both-addresses:5/0

add action=mark-routing chain=prerouting connection-mark=pppoe-out1_conn \
    disabled=no in-interface=LAN-1 new-routing-mark=to_pppoe-out1 \
    passthrough=yes

I use the “both-addresses” type of load balancing,Everything works fine.
If I use the “both-addresses and both-port” type of load balancing will lead to failure to access some Forum Login,Similar NTH.
my settings are not correct?

Thank you
Regards

5

1.Can you tell me why add ‘dst-address-type=local’ ,because of security reasons?

You’re port forwarding, so you should only destination NAT connections that initially were destined to a router IP address (dst-address-type=local). Otherwise you risk that a client behind the router connecting out to the Internet randomly chooses one of those ports to initiate a connection to, say, a webserver. The destination NAT rule you had would have taken that connection and port forwarded it, leading to connection failure on the client.

I use the “both-addresses” type of load balancing,Everything works fine.
If I use the “both-addresses and both-port” type of load balancing will lead to failure to access some Forum Login,Similar NTH.
my settings are not correct?

This explains the difference between settings: http://wiki.mikrotik.com/wiki/How_PCC_works_(beginner)

The forum you’re using probably keeps state over connections using something other than cookies. Using a different PCC algorithm leads to you being seen by the forum as having different IP addresses, which leads to a failure.

6

Thank you very much :slight_smile:
I will gradually learn to understand it.

7

Tnx! :wink: