NAT rule confusion (one rule works and another doesn't)

I’m new to Mikrotik devices having used Cisco devices for quite a few years. I’m liking the flexbility of Mikrotik J
I am trying to port map the same external IP address but with different ports going to different internal addresses. When I compare what they say on this forum and other sites it looks the same but one of my ports works and another doesn’t.
Here’s my setup:

External IP range: 123.123.123.176/28
Internal IP range: 10.10.0.0/16

I have a text externally available machine on 123.123.123.183. I can currently receive UDP requests on 1194 (to internal IP 10.10.1.16) without any issues. I have set up TCP ports on 12000 (to internal IP 10.10.1.224) and 12001 (to internal IP 10.10.1.16). I have netcat listening on those ports as a test, but telnetting to either of those using the external IP from other hosts times out.

I am probably doing something really stupid, so sorry for my noob knowledge! I am running RouterOS 6.38 by the way.

Thank you :slight_smile:

/interface ethernet
set [ find default-name=ether11 ] name=Local
set [ find default-name=ether1 ] name=Public

/ip address
add address=10.10.0.1/16 interface=Local network=10.10.0.0
add address=123.123.123.179/28 interface=Public network=123.123.123.176
add address=123.123.123.190 interface=Public network=123.123.123.190
add address=123.123.123.183 interface=Public network=123.123.123.183
add address=123.123.123.180 interface=Public network=123.123.123.180
add address=123.123.123.181 interface=Public network=123.123.123.181
add address=123.123.123.182 interface=Public network=123.123.123.182
add address=123.123.123.189 interface=Public network=123.123.123.189
add address=123.123.123.188 interface=Public network=123.123.123.188
add address=123.123.123.184 interface=Public network=123.123.123.184

/ip firewall address-list
add address=10.10.0.0/16 list=Local

/ip firewall filter
add chain=input connection-state=established,related
add action=drop chain=input in-interface=Public
add chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface=Public
add action=accept chain=forward connection-state=new in-interface=Local
add action=accept chain=forward dst-address=10.10.1.16 dst-port=1194 protocol=udp
add action=accept chain=forward dst-address=10.10.1.224 dst-port=12000 protocol=tcp
add action=accept chain=forward dst-address=10.10.1.16 dst-port=12001 protocol=tcp
add action=drop chain=forward

/ip firewall nat
add action=dst-nat chain=dstnat dst-address=123.123.123.183 dst-port=12000 in-interface=Public protocol=tcp to-addresses=10.10.1.224 to-ports=12000
add action=dst-nat chain=dstnat dst-address=123.123.123.183 dst-port=1194 in-interface=Public protocol=udp to-addresses=10.10.1.16 to-ports=1194
add action=dst-nat chain=dstnat dst-address=123.123.123.183 dst-port=12001 in-interface=Public protocol=tcp to-addresses=10.10.1.16 to-ports=12001
add action=src-nat chain=srcnat src-address-list=10.10.1.16,10.10.1.224 to-addresses=123.123.123.183
add action=masquerade chain=srcnat out-interface=Public
/ip route
add distance=1 gateway=123.123.123.177

You mean telnet fails from other internal hosts to public IP?
If so then you need hairpin NAT:
https://wiki.mikrotik.com/wiki/Hairpin_NAT

No sorry I wasn’t clear. I meant from any external host.

I mean telnet 123.123.123.183 12000 or 12001

I don’t see anything wrong. Check if you have some hits on dstnat rules and also if you see packets to destination hosts going out via Local interface (use Tools->Torch). If you do, it’s a problem on target device. It might have firewall that allows connections from local subnet but not from others.

Thank you for your help and reassurance. I don’t feel quite so stupid :wink:
Assuming I am using it correctly I ran torch on the Public and Local interfaces:

Public
torch Public port=12000 ip-protocol=tcp src-address=0.0.0.0/0 dst-address=0.0.0.0/0

MAC-PROTOCOL    IP-PROTOCOL SRC-ADDRESS                                  SRC-PORT      DST-ADDRESS                                  DST-PORT              TX         RX TX-PACKETS RX-PACKETS
ip              tcp         88.88.88.207                                59986         123.123.123.183                                  12000               0bps     592bps          0          1

Local
torch Local port=12000 ip-protocol=tcp src-address=0.0.0.0/0 dst-address=0.0.0.0/0

MAC-PROTOCOL    IP-PROTOCOL SRC-ADDRESS                                  SRC-PORT      DST-ADDRESS                                  DST-PORT              TX         RX TX-PACKETS RX-PACKETS
ip              tcp         10.10.1.224                                 12000         88.88.88.207                                1024              592bps       0bps          1          0

So the packets seem to be coming in on the Public interface and also on the Local interface. However both when netcat is not running (no open port) and when it is the result is the same. The 88.88.88.207 address is one of the external machines I have used for testing the connection. It’s not behind any firewalls.