port 443 not routing through

RouterOS General
1

Hello,

Although the NAT rules for routing port 80 through the router are fine, the same rules using port 443 do not route through.

 chain=dstnat dst-address=xxx.xxx.xxx.xx protocol=tcp action=dst-nat to-addresses=192.168.0.2 to-ports=80 

chain=srcnat src-address=192.168.0.2 protocol=tcp action=src-nat to-addresses=xxx.xxx.xxx.xx to-ports=80

This works.

 chain=dstnat dst-address=xxx.xxx.xxx.xx protocol=tcp action=dst-nat to-addresses=192.168.0.2 to-ports=443 

chain=srcnat src-address=192.168.0.2 protocol=tcp action=src-nat to-addresses=xxx.xxx.xxx.xx to-ports=443

This does not.

The error clients get is; “The connection to ‘www.our-domain.net’ has terminated unexpectantly. Some data may have transferred.”

How can I fix this?

Thank you in advance.

~James

2

Why there are no dst-port values? Are you trying to redirect all connections regerdless of port to single port 80 and 443? Can you explain exactly what do you want to achieve by these rules? Do you use webproxy?

3

Thank you for your reply.

I had used those NAT rules from earlier advice, although, as of my last posting, I added the dst-port numbers to the first chain and src-port numbers to the second chain. Port 443 is now passing through the router. All is well.

I do have another question, however; how would I redirect, let’s say, port 80 to port 8080?

Once again, thank you for your response.

~James

4 



add chain=dstnat src-address=(your address) protocol=tcp dst-port=80     action=redirect to-ports=8080
5 
add chain=dstnat src-address=(your address) protocol=tcp dst-port=80     action=redirect to-ports=8080

[/quote]

I’m guessing he doesn’t need redirect but src-nat. Redirect is for sending a port to the routers address only, not a machine behind it. You should also leave the to-ports as 0-65535 on most entries. In your case I think you want to change one port to another then use to-ports NNN to specify the port.

chain=dstnat dst-address=xxx.xxx.xxx.xx protocol=tcp DST-PORT=80 action=dst-nat to-addresses=192.168.0.2 to-ports=0-65535

chain=srcnat src-address=192.168.0.2 protocol=tcp action=src-nat to-addresses=xxx.xxx.xxx.xx to-ports=0-65535

The srcnat shouldn’t be saying port 443 - that means every request/reply it sends out will be coming from port 443…

6

I do have another question, however; how would I redirect, let’s say, port 80 to port 8080?