Port Forwarding from VPN to Client on Ethernet

RouterOS Beginner Basics
1

Hello Community,
its the first time i use Mikrotik products, so please excuse my very basic question.

I have following Setup:

VPN ( OpenVPN) Server 10.8.0.x —> LTE → Mikrotik LtAP LR8 LTE ( Openvpn Client ) 10.8.0.2 |192.168.123.254 → Client 192.168.123.100

I can connect to the configuration website of the LtAP - and now i would like to forward Port 8080 to the port 80 of 192.168.123.100 so that i can connect to the webserver of this device.

Can anybody tell me how the nat/rules/firewall settings have to look like ?
Thanks a lot !

Thomas

2

Hi Thomas.

So you have an MT device acting as a router and behind that router you have client PC.
Somewhere else on the internet you have an openvpn server which is where attached to what??

Why would you port forward to a client PC is the question seemingly being posed. One port forwards to a server.
In other words, need a clearer description perhaps with a network diagram.

3

Hey Anav,

sorry that i used “server/client” so interchangeable.

To make it more clear: I have a laptop and the MT in a VPN network. ( 10.8.0.x ). This works and i can acces the config-panel of the MT from my laptop.
On the wired ethernet-port of the MT i have an other “network” ( 192.168.123.x/24 ). In this network all devices can talk to each other and its fine.
Now i would like to setup a port-forewarding on the MT so that wenn i acces its vpn-ip ( 10.8.0.2 ) on port 8081 that it then sends the packages to a computer on the wired network.

Like this: Laptop ( 10.8.0.1 ) >>> VPN >>>> Mikrotik ( VPN IP: 10.8.0.2 Local IP: 192.168.123.254 ) >>>> Computer ( 192.168.123.1:80 )


Thanks for your help !

4

It can differ a bit depending your exact config, but if the IP of the VPN client is static, it can look something like below:

/ip firewall nat add chain=dstnat dst-address=10.8.0.2 port=8081 action=dst-nat to-addresses=192.168.123.1 to-ports=80

Instead of dst-address, you can also use in-interface/list, etc

5

Dear CZFan,

thansk for your hint! This was the right point into the direction i needed. Got it working now also with the help of the wiki that i foud by googeling your hint :slight_smile:

Thomas