hi guys.
i have a small wireless isp.
i share internet to users just by one valid ip.
because of connect dvr and watching cameras i do NAT in my router and set a port on my valid ip on my user.
EX: static ip: 37.143.X.X
wan port: 8182
my user local ip: 192.169.135.117
dvr ip: 192.168.0.100
now when enter valid ip in browser it jump to my user config microtic page.
37.143.X.X:8182 ----------> 192.169.135.117
now i want to do nat on my user microtic to when you enter valid ip it connect to dvr not to microtic.
i do this but it not work:
ip firewall nat add chain=dstnat dst-address=37.143.X.X protocol=tcp dst-port=8182 action=dst-nat to-addresses=192.168.0.100 to-ports=80
Change dst-address to 192.169.135.117
(by the way, that’s not a valid private IP - it should be 192.168…)
Or just drop the dst-address entirely, and change it to “in-interface=WAN”
(where WAN = ether1, wlan1, or whatever the router’s wan interface might be)
I recommend this, as it’s one less thing to change if the user’s IP ever needs to be changed.
If you want the user to be able to use the public IP address to reach their DVR, but from behind their own router, then you would need to leave the original rule quoted above, ADD the rule I suggested, and then add a 3rd rule:
out-interface=LAN, src-address=192.168.0.0/24 action=masquerade
This is necessary for NAT hairpin.
thanks for your answer.
i think this pic help more:
