New MikroTik user struggling with port forwarding

RouterOS Beginner Basics
1

Hello,


I’ve been in IT for over 10 years and just recently discovered the awesomeness of MikroTik. I recently installed a hAP AC router for my home use and I’ve been blown away by the capabilities and performance of the device. I am running into a road block though. I’m trying to do some port forwarding from my WAN to an ip address on my private network that is behind a NAT. I’ve read the documentation and followed the steps as well as watched a few youtube videos showing the process but for the life of me cannot get it to successfully forward the port. I can access the port no problem from within my lan but cannot access from the wan side of the router. I’m sure it’s something simple I’m missing but I’ve tried just about everything, including disabling on the existing filter rules and I still can’t get this port to forward properly. I’m hoping someone with a lot more experience with RouterOS can help me get this straightened out because otherwise I’m incredibly happy with my new router.

P.S. I’m running routerOS v6.37.5

2

Put your export here and add what port should be redirected where.

3

/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade” out-interface=ether1
add action=dst-nat chain=dstnat dst-address=172.16.0.15 dst-port=8123 in-interface=ether1 protocol=tcp to-addresses=172.16.0.15 to-ports=8123Here’s my NAT rules the masquerade rule was there by default. I’m trying to redirect traffic from the WAN to 172.16.0.15 on port 8123

4

Hello,

the dst-address should be the public WAN IP address.

5

Ok, how do I set that up if my WAN IP is dynamic from my ISP?

6

Nevermind, I just left that blank and it seems to be working, thanks for the tip I’ve been pulling my hair out the last few days!

7

If you have dynamic WAN address, it’s good idea to use dst-address-type=local for dstnat rules. If you don’t set any specification for dst address, it will dstnat all connections, even outgoing ones, so you won’t be able to connect to port 8123 anywhere else. There’s a good chance you won’t ever need to, but still…

8

Thanks for that Sob - you just solved a problem for me. Yesterday I changed my internet connection in use from a DSL with Static IPs to a Cable connection with a Dynamic address. I run a web server so I have port 80 forwarded to the server. Could not get to websites from that network.

9

You can also set in-interface to your wan interface if you have dynamic ip. There are a lot of options in configuring the firewall.

10

I hope it will help you
add action=dst-nat chain=dstnat comment=FTP dst-address=MY_PUBLIC_IP dst-port=21 in-interface=WAN protocol=udp to-addresses=MY_PRIVATE_IP to-ports=21

MY_PRIVATE_IP is the IP of the ftp server (private)

11

Actually I DID have both the destination IP and In-Interface when I had the traffic coming into my static DSL internet connection. However as part of moving stuff over to the Dynamic cable connection, I had to remove the destination IP and In-interface because traffic could have come in via either the DSL or cable connection. Now that the cutover is completed, I was able to put the in-interface back in as the DSL is no longer used for inbound traffic to the web server.

12

If you have more than one “WAN” interface or more interfaces that you want to nat or masquerade over you can group them in a list and then set in-interface-list.

13

Hi there. I have a similar problem with this RB750G I just got. I"m quite new to this and have been testing this device the whole week.

It is a very interesting hardware and seems to be very powerful.

I am currently trying to forward a single port inwards but having totally no luck with it.!

the following is the config for my firewall, which I left as is by default followed by the NAT config forrwarding port 8554 to an internal IP

/ip firewall filter
add action=accept chain=input comment=“default configuration” protocol=icmp
add action=accept chain=input comment=“default configuration” connection-state=established,related
add action=drop chain=input comment=“default configuration” in-interface=ether1-gateway
add action=fasttrack-connection chain=forward comment=“default configuration” connection-state=established,related
add action=accept chain=forward comment=“default configuration” connection-state=established,related
add action=drop chain=forward comment=“default configuration” connection-state=invalid
add action=drop chain=forward comment=“default configuration” connection-nat-state=!dstnat connection-state=new in-interface=ether1-gateway

/ip firewall nat
add action=masquerade chain=srcnat comment=“NAT inside to outside” out-interface=pppoe-out1
add action=dst-nat chain=dstnat comment=“NVR 8554” dst-port=8554 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.50 to-ports=8554
add action=dst-nat chain=dstnat dst-port=8554 in-interface=ether1-gateway protocol=udp to-addresses=192.168.88.50 to-ports=8554

any assistance greatly appreciated!

14

What, even though “in-interface=ether1” has been specified?

15

If you set in-interface, then your outgoing traffic is fine, it won’t match. But setting in-interface conflicts with hairpin NAT setup (when you use public address to access server, which is in same LAN). And in some cases, in-interface is too broad specification. If you have only one public address, you most likely won’t notice any problem. But if you had routed public subnet, then dstnat rule with just in-interface would match traffic to all those addresses. So it’s still good habit to use some way to specify that you’re interested only in traffic to local address(es).