]Hello,
/interface bridge
Sounds fishy to me, almost like a homework assignment. but in any case…
the one thing that looks like an obvious error is this…
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether2 network=
192.168.1.0
Should be
add address=192.168.1.1/24 comment=defconf interface=bridge network=
192.168.1.0
I made the proposed change, no change. It is the default configuration for the router with changes on NAT., It should be a simple and trivial thing but it doesn’t work, I have the impression that you have the 3 connections that open at the same time, I can change it. I tried to mark the connection with Mangle and then Fasttrack but it doesn’t work either.
At the LAN level everything works.
If I put a regular router with NAT function everything is ok, maybe there is an incompatibility between my automation network and the MikroTik router or it is another setting that I did not do, of course it is the tcp protocol, the connection is http on port 80 .
add action=dst-nat chain=dstnat comment=win_box_9999 dst-port=9999 \
in-interface=ether1 protocol=tcp to-addresses=192.168.1.1 to-ports=8291
This is wrong as well. Winbox is used on the closest IP on the router. So from outside, it’s your outside IP 192.168.xxx.10, and from inside, it’s your inside IP 192.168.1.1.
Nat is not needed for Winbox.
But you should not do this. Winbox should be reached using VPN.
If you can not use VPN, then
- Use port kncking
- Long and secure password
- do not use default port (9999) should be ok.
- Add an access rule to limit access to only some specific IP.
- Log all access to the router to an external Syslog server (or use email alert from router)
Ok, I agree that I could use the Winbox connection from the WAN and otherwise, I preferred this connection to check NAT and that’s not my problem: I can’t access the LAN equipment from the WAN, respectively several programmable controllers that work each as a webserver on port 80 http connection. In the posted configuration I try to connect on port 88 WAN to the PLC from 192.168.1.240 port 80 LAN. This doesn’t work for me, I don’t go through “syn_sent” and I have 3 connections at once. I’m sorry I also put a print screen but I think it doesn’t let me put images.
Do you have multiple NAT, since your router has 192.168.xx.10 (private IP)?
We have a company vpn, all ports are open and with a regular router like zyxel n300 the installation works. I would have liked to switch to MikroTik due to the multiple facilities but it seems that there is an incompatibility or more study is needed.