Port Forward?

Right. I have no idea where to post this, so I reckon’ it ought to go here.

I want to port forward.

The program I want to port forward is Minecraft, a Minecraft Server to be more exact. I’m pretty new to this, but I already successfully done it a couple of times for my friends, but they have different routers. The rule I want to set up:

Protocol: UDP/TCP
In-Port:25565
Out-Port:25565
Destination IP: PC IP

Now, when I go to my router homepage, and login with my account information, the webpage looks completely different then anything Mikrotik I could find anywhere on the internet. More importantly, I can’t find the Port Forward section. Anywhere.

I decided I should use winbox, and it worked (sorta). I could log in, and set up the rule (IP → Firewall → NAT), but even after setting it and enabling it. nothing happens or works. Every port checking website/program I’ve been to tells me the port is closed, even if my rule’s enabled. I’ll also mention that I tried various Port Forward programs, but they never work.

My router webpage.





The rule.




Router: Canyon CR-BR 2
OS: Windows 7 Home Premium

How do I open it? Please help.

P.S.- I’m really new at this all, so I don’t think I’ll understand all expressions and shortcuts.

It sounds like you are on the right track but have only got half way there. NAT handles the Network Address Translation but assuming that you have forwarding path filters active in the firewall you also need to make enter a filter in the forwarding chain (look to the left of the NAT tab) to permit the relevant traffic. You will want to permit forwarding from the relevant incoming WAN interface to the relevant private IP on the ports required. You will probably need a couple of rules to cover TCP and UDP.

If you need more help upload your config using output from /export compact in a terminal session - it will give more useful information than the images.

If nothing else, you need at least move the port number from Src. Port field to Dst. Port. Source port is random port on remote machine from where the packet comes from, you don’t care about that. You are interested in packet’s destination port. Then, if you did not set anything else, it should start to work. If not, check forward filters as CelticComms suggests.

But even if it works, you’re not done yet, because it will forward all connections to that port, even outgoing ones. To make it work properly, you need to limit forwarded packets to only those coming for router itself. To do that, do one (only one) of the following:

a) on General tab, enter your public IP address in Dst. Address field (if you have static one)
b) on Extra tab, under Dst. Address Type set Address Type to “local”
c) on General tab, select your WAN interface in In. Interface field

First of all, thank you for the quick feedback.

@Sob:

Right. I did everything you said (I have a static IP), but it doesn’t work yet. I’m going to do what CelticsComms suggested.

@CelticComms:

What exactly do I type in the terminal? I get errors on whatever I try. (I’m not at all familiar with that syntax)

P.S.- I’m going to be gone for a couple of days now, unlikely to have internet access. This might be my last post in the next 4 days. :confused:

Edit:

I tried your thing CelticComms, the filter; either it didn’t work or I set it up wrongly (probably the second >.<)

Try:

/export compact

Although this is probably enough, as we don’t care about most of your other settings:

/ip firewall export compact

Perhaps except IP address, you do have a public one (not 192.168.x.x, 10.x.x.x or 172.16-31.x.x), right?

None of them work. ._.

I keep getting errors.

“bad argument name compact (line 1 column 21)”

It’s meant for the letter “c” in “compact”.

I now see at screenshots that you have an old version of RouterOS and it does not support “compact”, so try without it.

Looks like from the first screenshot, you’re running v3.30, so the “compact” option doesn’t exist. It was introduced in v5.12.

Just run it like this:

/ip firewall export

Ahh! I was wondering if that might be the problem...

Here's the output:


aug/17/2002 13:14:09 by RouterOS 3.30

software id = T8RG-KEYU

/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s
tcp-close-wait-timeout=10s tcp-established-timeout=1d
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=forward comment="" disabled=no dst-address=
10.168.50.196 dst-port=25565 protocol=udp
/ip firewall nat
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=
10.168.50.196 dst-port=25565 protocol=udp to-addresses=10.168.50.196
to-ports=25565
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no


Useful?

The bold marked address is wrong. Instead, you must put there the public IP address you got from ISP (the one on your WAN interface):

/ip firewall nat
add action=dst-nat chain=dstnat comment=“” disabled=no dst-address=
10.168.50.196 dst-port=25565 protocol=udp to-addresses=10.168.50.196
to-ports=25565

And if you need both udp and tcp, then add another exactly same rule, except for the different protocol.

As for the forward chain, if you don’t have any other rule there, you don’t need even this one, because by default everything is allowed. But it does not hurt anything if you keep it there (and add another one for tcp). You will at least see that forwarded packets came through router. :slight_smile:

Ehh... It still doesn't work. :frowning:

By the Public IP Adress, you mean the one I get when I go to a site like http://whatismyipaddress.com ?

aug/20/2002 03:57:50 by RouterOS 3.30

software id = T8RG-KEYU

/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s
tcp-close-wait-timeout=10s tcp-established-timeout=1d
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=forward comment="" disabled=no dst-address=
10.168.50.196 dst-port=25565 protocol=udp
/ip firewall nat
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=
161.53.51.207 dst-port=25565 protocol=udp to-addresses=10.168.50.196
to-ports=25565
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no

Yes. But only if it’s the same address as your router has. When you open IP->Addresses in WinBox, you see 161.53.51.207 in there, right? Because if not, and instead your ISP gives you only some 192.168.x.x, 10.x.x.x or 172.16-31.x.x, then you are out of luck and can’t run any server accessible from internet.

Another thing, add second NAT rule for TCP (currently you have only one for UDP). I know nothing about Minecraft, but pages found by Google mention either TCP/UDP or just TCP, so that’s the one you want in any case.

Appereantly, I’m out of luck. My Ip Adress, that the winbox shows, starts with a 10. D=

Anyways, thanks for the help! Once I change my Internet Provider, which I’ll definitely do sooner or later (my internet’s slow as crap) I’ll try it again! Thank you all for your time, once again! :3

You have a really old RouterOS version. I suggest you to upgrade.

I wasn’t the one who installed it, or the router. I’m afraid that I might mess something up. ._.