Noob ? - Sorry. Nat port 80 breaking outbound web

RouterOS Beginner Basics
1

Hi all,

New to Microtik, not knew to computers and CLI.

I took the port forwarding syntax directly from the wiki, of course changing to my IP’s and port 80 for inbound web. Here is the syntax from the wiki:

/ip firewall nat add chain=dstnat dst-port=80 action=dst-nat protocol=tcp to-address=10.x.x.x to-port=80

As soon as I add that to the MK, outbound webbrowsing breaks. Not only that, I cannot Winbox in or SSH in to the router, but previous logins stay alive. If I disable the line it still breaks webbrowsing. I have to remove the line, then everything functions again.

Nothing else it setup on the box, except internal DHCP server. The external is on a cable modem and is also set to DHCP.

Any help appreciated.

Thanks.

2

Do you have any other entires in “/ip firewall nat”? You need a masquerade or srcnat also.

/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether1

If ether1 is not your WAN interface, change to the appropriate interface.

3

I am pretty sure I do.

I changed the name of ether1 to OptOnline-Port.

So my first Firewall rule 0 is:

chain=srcnat action=masquerade out-interface=OptOnline-Port

I have a temp fix in for the port 80 forward by declaring dst-address=69.x.x.x (My outside IP). But the IP is on DHCP and tough it rarely changes, I would like the box to be dynamic.

4

My favorite fix:
/ip dhcp-server lease
print
make-static X

where X is the line number of the lease for your server. The server will always get that ip when it requests one, and will not be issued to anyone else.

5

Your temp fix is actually one of the real fixes. Your NAT rule was way too general, so it basically read as, any connection that goes through the router with a dst-port of 80, redirect to this IP. This includes all LAN and WAN traffic, hence why it broke your web browsing. You could also specific an in-interface if you don’t want to specify your public in case it is a DHCP one that may change.

You need to be careful of not only the order of your rules, but how general or specific they are. If they are too general they will match more than you want them to do, if they are too specific they will not match everything that you want them to.

6

Thank you Guys.

I believe I have the concept down now.

I have used the In. Interface and eliminated the Dst. Address and all is working well.

This setup is very similar to the old Checkpoint firewalls on the Sun Station’s. Brings back memories of 1995! :astonished:

Very powerful once you have the concept down, also very dangerous in a rookies hands.