Please help about nat port from internal ip to specific WAN

RouterOS General
1

Hi Consultants,
I wonder if someone can help me.
I have 3 wan interfaces configured and running as PPPoE client type, load balacing bandwidth was set over 3 WAN on CCR1009-7G-1C-1S+ firmware 3.33

wan1 ( PPPoE public ip: 111.111.111.111)
wan2 ( PPPoE public ip: 112.112.112.112)
wan3 ( PPPoE public ip: 113.113.113.113)

bridge-lan (internal subnet: 192.168.101.0/24)

Web-Server1 ip: 192.168.101.22

Web-Server1 <-------> bridge-lan <---------CCR1009-7G-1C-1S+----------> wan1, wan2, wan3 <---------------> Internet

I openning port 9999 to Web-Server1:
-------------------Command on CCR1009-7G-1C-1S+-------------------------------------------
ip firewall nat
add action=dst-nat chain=dstnat dst-address-type=local dst-port=9999 protocol=tcp to-addresses=192.168.101.22 to-ports=9999
add action=masquerade chain=srcnat dst-address=192.168.101.22 dst-port=9999 out-interface=bridge-lan protocol=tcp src-address=192.168.101.0/24

everything is great, the port 9999 was open success, internet users can access to the Web-Server1 by any public ip (wan1, wan2, wan3):
http://111.111.111.111:9999 ---- success
http://112.112.112.112:9999 ---- success
http://113.113.113.113:9999 ---- success

After that we have another Web-Server2, the developer require open the port 8888 to Web-Server2 on wan3 only,
internet users can only access to the Web-Server2 via wan3, not via wan1 and wan2.

please help me do that.

Best Regards
Hien Nguyen

2

(deleted: original post modified)

3

Thanks for your answer!
I was open port by that commands, but it opening port 9999 on ALL wan:
-------------------Command on CCR1009-7G-1C-1S+-------------------------------------------
ip firewall nat
add action=dst-nat chain=dstnat dst-address-type=local dst-port=9999 protocol=tcp to-addresses=192.168.101.22 to-ports=9999
add action=masquerade chain=srcnat dst-address=192.168.101.22 dst-port=9999 out-interface=bridge-lan protocol=tcp src-address=192.168.101.0/24

I want to open the port 8888 on only Wan 3 to Web-Server2 , i don't know how to do that.
I hope you can help me do that!

4

web server 2 address??? 192.168.101.33 on example
core router internal network adress?? 192.168.101.1 on example

/ip firewall nat
add chain=dstnat dst-address=111.111.111.111 dst-port=9999 protocol=tcp action=dst-nat to-addresses=192.168.101.22 to-ports=9999
add chain=dstnat dst-address=112.112.112.112 dst-port=9999 protocol=tcp action=dst-nat to-addresses=192.168.101.22 to-ports=9999
add chain=dstnat dst-address=113.113.113.113 dst-port=9999 protocol=tcp action=dst-nat to-addresses=192.168.101.22 to-ports=9999
add chain=dstnat dst-address=113.113.113.113 dst-port=8888 protocol=tcp action=dst-nat to-addresses=192.168.101.33 to-ports=8888
# if all is configured correctly no more rules are needed. If webserver have wrong or another gateway add this two:
add chain=srcnat src-address=192.168.101.1 dst-address=192.168.101.22 action=src-nat to-addresses=192.168.101.1
add chain=srcnat src-address=192.168.101.1 dst-address=192.168.101.33 action=src-nat to-addresses=192.168.101.1
5

Thanks you for your answer!
Your code not work for us or i don’t doing wrong something, it was not open port 8888 to Web-Server2 (192.168.101.33) via any wan.
Could you please help me another solution ?