Needed help with Port opening

RouterOS General
1

heyy guys, here’s the thing.

I made a JSP application that uses the port 8765, and installed it on a Server. the server has the IP 172.16.32.3

the users on the other end have the IP range: 10.100.x.x/16, then pass by a change to 192.168.60.0/24 then through a Mikrotik one with the IP 172.16.32.31. The IP address that the application sees is 172.16.32.31 as it is the last hop b4 the destination.

The Mikrotik router is Refusing the connection I make through that port so the application throws me a Connection Refused exception. When I connect myself after the mikrotik router with the IP 172.16.32.7, I can get normal results (means I bypassed the Mikrotik router).

The result request is made through this URL:

http://172.16.32.3:8080/Checkers/CMMAC_jsp

so it uses the 8080 to connect to the tomcat server but the application uses 8765 port to communicate the server and the client parts.

so what can I do to for the mikrotik to stop refusing my connection? I’m using the GUI (winbox) to do the configuration so any assist with that would be priceless and thx in advance

2

If I understood correctly then you have to add dst-nat rule which will forward specific port to the server.
Example is in the manual:
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT#Destination_NAT

3

I saw that page in my researches, and I tried many settings conforming to the example.. but it’s not working. I suspected that it has to do with the use of 2 ports: 8765 and 8080 that’s why I provided the whole IPs and Ports hoping that some1 can guide me through the thing.. I don’t know if u understood what I meant

I don’t know what to put in the dest. port and To-ports. 8080 or 8765. or if I should put anything in the dest. IP or Src. IP

must it be:

any:8765 → 172.16.32.3:8765
or
any:8080 → 172.16.32.3:8765
or
any:8080 → 172.16.32.3:8080
or
192.168.60.0/24:8080 → 172.16.32.3:8080
or
172.16.32.31/24:8765 → 172.16.32.3:8765


u see? many possibilities that I can make, but my problem is I can’t find the right logic to apply the rule.


EDIT: I tried:

/ip firewall nat add chain=dstnat dst-port=8765 action=dst-nat protocol=tcp to-address=172.16.32.3 to-port=8765


and that didn’t work.

4

basically you need following rule:
/ip firewall nat
add dst-address=172.16.32.31 protocol=tcp port=8080 chain=dstnat
action=dst-nat to-address=172.16.32.3 to-ports=8765