Hello,
I have read many posts but i am not able to handle it.
How to forward port if the wan address is dynamic (pppoe)?
add action=dst-nat chain=dstnat disabled=no dst-port=8888 in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.88.10 to-ports=8888
It does not work.
Thank you in advance.
Your rule should already work if you test it from outside. If it doesn’t, packets are probably blocked in forward chain, so make sure they are enabled. The simplest way should be this rule:
/ip firewall filter
add chain=forward connection-nat-state=dstnat
If you’re trying to connect to your public address from LAN, you need hairpin NAT. You’ll need to replace in-interface in your original rule with dst-address-type=local and add srcnat rule as described in wiki.
What do you think about the rule below:
add chain=dstnat action=dst-nat dst-address=!192.168.88.1 dst-address-type=local dst-port=8888 protocol=tcp to-addresses=192.168.88.10 to-ports=8888
I like it. Does it work for you? It should.
It works only from outside, but if I try to access my WAN from LAN it does not work unfortunately.
[admin@MikroTik] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface=pppoe-out1 log=no log-prefix=""
1 chain=srcnat action=masquerade src-address=192.168.88.0/24 dst-address=192.168.88.0/24 out-interface=pppoe-out1 log=no log-prefix=""
2 chain=dstnat action=dst-nat to-addresses=192.168.88.253 to-ports=8888 protocol=tcp dst-address=!192.168.88.253 dst-address-type=local dst-port=8888 log=no log-prefix=""
3 chain=dstnat action=dst-nat to-addresses=192.168.88.253 to-ports=12000 protocol=tcp dst-address=!192.168.88.253 dst-address-type=local dst-port=12000 log=no log-prefix=""
I do not know what is wrong?
This below works. I changed in second rule the out-interface from pppoe into the bridge.
chain=srcnat action=masquerade out-interface=pppoe-out1 log=no log-prefix=""
chain=srcnat action=masquerade src-address=192.168.88.0/24 dst-address=192.168.88.0/24 out-interface=bridge log=no log-prefix=""
chain=dstnat action=dst-nat to-addresses=192.168.88.253 to-ports=8888 protocol=tcp dst-address=!192.168.88.253 dst-address-type=local dst-port=8888 log=no log-prefix=""
chain=dstnat action=dst-nat to-addresses=192.168.88.253 to-ports=12000 protocol=tcp dst-address=!192.168.88.253 dst-address-type=local dst-port=12000 log=no log-prefix=""
Coud someone explain to me this situation?
Your change is correct. It’s what hairpin NAT does, it changes source of LAN->LAN packets. And their out-interface is LAN, in your case “bridge”. See the link I posted, it’s explained there very nicely, step by step what happens.
I’m new in MikroTiks world and I have just bought a RB3011UiAS-RM. A fantastic product.
I have port forwarded my NAS so I can reach it from outside, no problems. But I can´t reach it from my lan network and I know that I need to loopback/hairpinning.
Do I need to add one or two extra functions under “FIREWALL” “NAT” or do I need to modify the port forwarding that I already configured?
I have dynamic IP from my ISP so I use MikroTik´s DDNS.
