Port-forwarding does not work, but why?

[Sob]

Yep, two hints:

 tag is very useful thing.
2) Read my previous post again and this time pay a little more attention (extra subhint: you did not touch your dstnat rules).

[dg3feh]

@Sob

Yep, two hints:

 tag is very useful thing.
 
 what do u mean by that?
 
2) Read my previous post again and this time pay a little more attention (extra subhint: you did not touch your dstnat rules).[/quote]

As fare as I understod, the Hairpin works by masquerading. The internal call from LAN to the external address is redirected to the LAN address of the server by

/ip firewall nat
add action=masquerade chain=srcnat comment=Hairpin dst-address=192.168.1.252 \
dst-port=22,80,443 out-interface=ether1 out-interface-list=all protocol=\
tcp src-address=192.168.1.0/24

[Sob]

That’s just a half of it. You still need proper dstnat rules. And your current ones only work for connections coming from internet (via PPPoE-ALICE interface).

[dg3feh]

@Sob

That’s just a half of it. You still need proper dstnat rules. And your current ones only work for connections coming from internet (via PPPoE-ALICE interface).

Hm. As far as I understood: We are coming from the inside (e.g. 192,168.1.100) and want to connect to the WAN addresss. Therefore we catch all traffic on port 22,80,443 going to the server (192.168.1.252) from the LAN (192.168.1.0/24) masqurade it and send it to the internal interfaces (ether1).

I follwed that Tutorial: http://wiki.mikrotik.com/wiki/Hairpin_NAT

[Sob]

But there will be no traffic going to server, because dstnat is what redirects it there. Take this rule:

/ip firewall nat
add action=dst-nat chain=dstnat comment="Portforwarding HTTP zum Server" \
dst-port=80 in-interface=PPPoE-ALICE log-prefix=FW80 protocol=tcp \
to-addresses=192.168.1.252 to-ports=80

It tells router to catch tcp/80 packets coming via PPPoE-ALICE interface. When you connect to your public address from LAN, in-interface will be your LAN interface and this rule will not catch (and redirect) anything. Instead, the connection attempt will go to router itself and will fail (because you don’t have anything running on port 80 on router; if you didn’t move web administration to port 81, you’d get that).