Port Forward trough L2TP VPN to second network

RouterOS Forwarding Protocols
1

Hey guys!
Sorry for bad english :slight_smile:
I have problem regarding port forwarding!
I have one part of my network as described on this picture!!

My problem is this!!
I need to Access a server that has IP address 192.168.60.100 port 8080 trough public IP on Mikrotik WAN1!
On other location we have an ISP 3G/4G router that has connection to the internet but we cannot access that public IP directly so I created VPN using L2TP and it works OK.
So now I can access server and other devices on network 60.0/24 from my 10.1/24 network and from other external devices when they connect to L2TP server on network 111.0/24
As I said, now I need to access port 8080 on server 192.168.60.100 directly using port forward and Im stuck!
I tried the following:

on first router: action=dst-nat chain=dstnat dst-port=8080 in-interface=ether1-WAN log=yes protocol=tcp to-addresses=192.168.60.100 to-ports=8080 – not working
on first router action=dst-nat chain=dstnat dst-port=8080 in-interface=ether1-WAN log=yes protocol=tcp to-addresses=192.168.111.48 to-ports=8080
on secod router action=dst-nat chain=dstnat dst-port=8080 in-interface=l2tp-out1 log=yes protocol=tcp to-addresses=192.168.60.100 to-ports=8080 – not working

can this be done in any way?
Kind regards,
Marko
Topology.jpg

2

You need to understand what happens. Let’s say a device from internet with address 1.2.3.4 connects to your port. Unless you block it by mistake using filter in forward chain, first packet reaches the server. Server sends reply back to 1.2.3.4. When the router (192.168.60.1) gets it, it will send it guess where? Using its default route towards 4G router. And 4G router will probably drop it itself, if it has stateful firewall, but even if not and it would eventually reach 1.2.3.4, it will be from wrong address, not from first router’s WAN address and won’t work.

So you can either:
a) Use srcnat/masquerade on first router, to make all forwarded packets look as if they were from 192.168.111.1. It’s simple, just one rule. But server won’t be able to see real source addresses.
b) Mark new incoming connections on l2tp-out interface of second router, and then mark routing for replies, to go back via the tunnel.