Plex port forwarding

stranger · May 25, 2023, 10:20pm

I cannot get port forwarding to work with Plex. I know somebody out there is using MikroTik routers successfully with Plex. It worked just fine on my previous router. I’ve searched these forums and reddit to death and I’ve tried many different things. Here is my current configuration (the default config + the NAT rule I created):

# may/25/2023 18:15:39 by RouterOS 7.9
# software id = PPLB-H4Y4
#
# model = RB2011UiAS
# serial number = HE608K6RET8
/interface bridge
add admin-mac=48:A9:8A:6F:BB:A1 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.10.10-192.168.10.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge comment=defconf ingress-filtering=no interface=ether5
add bridge=bridge comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge comment=defconf ingress-filtering=no interface=ether9
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=192.168.10.1/24 comment=defconf interface=bridge network=\
    192.168.10.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server lease
add address=192.168.10.254 client-id=1:30:5a:3a:5:d2:c4 comment=PC \
    mac-address=30:5A:3A:05:D2:C4 server=defconf
add address=192.168.10.252 client-id=1:50:e5:49:81:4:1c comment=PMS \
    mac-address=50:E5:49:81:04:1C server=defconf
add address=192.168.10.253 client-id=1:0:1b:a9:ac:5c:d8 comment=Printer \
    mac-address=00:1B:A9:AC:5C:D8 server=defconf
/ip dhcp-server network
add address=192.168.10.0/24 comment=defconf dns-server=192.168.10.1 gateway=\
    192.168.10.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.10.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=accept chain=dstnat comment=Plex disabled=yes dst-address=\
    192.168.10.252 dst-port=32400 in-interface-list=LAN protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=Plex connection-type="" dst-port=\
    32400 in-interface=ether1 protocol=tcp to-addresses=192.168.10.252 \
    to-ports=32400
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/lcd
set backlight-timeout=never
/system clock
set time-zone-name=America/Indiana/Indianapolis
/system identity
set name=RouterOS
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

anav · May 29, 2023, 12:59am

In Mikrotik, you only need one rule to allow port forwarding and it sort of comes as a default rule which you already have!!!
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN

Basically the above rule says drop everything from the WAN except for anything port forwarded.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Thus you need to delete the forward chain rule you created for port forwarding as its proper place is in NAT, which I believe you already put the rule.
Im assuming that the plex server is used only by external users via the WANIP address./domain name and the internal users use the LAN IP??

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

By the way its much better security and clearer of purpose to modify the default rule above to the following.

add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“allow port forwarding” connection-nat-state=dstnat
add action=drop chain=forward comment=“drop all else”

Although this is three rules compared to one before, it was implicitly allowed for LAN to go out WAN but also for LAN or vlans to see other LANs or vlans.
This is much tighter because we drop all traffic at the end. Thus, any traffic you wish to allow must go above the drop all rule.
Hence, we need to put in allow lan to wan traffic.
we need to make the port forward rule, simplified
then the drop rule…

If you had any other traffic you needed to allow in the forward chain one only needs to put it before the drop rule.