NAT issue : port 80 works, 443 does not

RouterOS Beginner Basics
1

Hello all.

Using MikroTik RouterOS 5.16, I have trouble whith opening port 443 and trying to NAT it to an another port inside the MikroTik router.

Port 80 is working fine, but the 443 til the port 8000 dows not. Have I done anything wrong here ? The 192.168.0.3:8000 is set up with HTTPS, and works fin inside in the LAN.

below is my active filer and nat rules

/bwa

filter rules

22 chain=input action=drop connection-state=invalid
23 chain=input action=accept connection-state=new in-interface=ether2-master-local
24 chain=input action=accept connection-state=established
25 chain=input action=accept connection-state=related
26 chain=input action=accept protocol=icmp
27 chain=input action=drop
28 chain=forward action=drop connection-state=invalid
29 chain=forward action=accept connection-state=new in-interface=ether2-master-local
30 chain=forward action=accept connection-state=established
31 chain=forward action=accept connection-state=related
32 chain=forward action=accept protocol=tcp dst-port=80
33 chain=forward action=accept protocol=tcp dst-port=443
38 chain=forward action=drop

nat rules

3 chain=srcnat action=masquerade out-interface=ether1-gateway
4 chain=dstnat action=dst-nat to-addresses=192.168.0.2 to-ports=80 protocol=tcp in-interface=ether1-gateway dst-port=80
6 chain=dstnat action=dst-nat to-addresses=192.168.0.3 to-ports=8000 protocol=tcp in-interface=ether1-gateway dst-port=443

2

Update ROS!!!

3

This setup looks correct. You don’t need the filter rules to allow ports 80 and 443 as it’s implied when you have NAT rules setup.

Go to Tools > Torch. Torch will show you what packets are coming and going from what interfaces. In a working scenario, you should see packets destined to port 443 coming in ether1. You should then also see packets destined to port 8000 leaving ether2 with a dst-ip of 192.168.0.3. Maybe you’ll find packets aren’t coming into the wan, or maybe they are but not going other the lan. or maybe you’ll find both are working, and it’s your server that’s not accepting the connections due to something like a wrong gateway defined in the server?

4

Nope, you need to allow them somehow. The best way (in most cases) is the magic rule:

/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat

But it requires newer RouterOS, 5.x doesn’t have it.

And the problem here is that firewall filter happens after dstnat. So if packet originally comes to port 443 and you change its destination to port 8000, you need to allow the latter in filter.

5

Bloody hell, I just checked my rules on several routers. Default config for forward chain was allow established, allow related, drop invalid. Which is why I’ve never had to add a rule for NAT’d connections.

6

Right, RouterOS by default allows everything and unlike in iptables, you can’t set default policy for chain. So unless you add a drop/reject rule at the end, everything not specifically blocked is allowed.

7

So my filter rules is correct set up ?

BTW, I changed the NAT rule from 8000 til 443 and sent it to my nginx instance and fixed the new port there instead. Now it works.

6 chain=dstnat action=dst-nat to-addresses=192.168.0.3 to-ports=443 protocol=tcp in-interface=ether1-gateway dst-port=443

8

If your goal is to allow all traffic from ether2-master, then allow connections to ports 80 and 443, and finally block the rest, you have it correct. If would work with port 8000 too, you’d just have to allow 8000 in forward chain instead of 443.