Port forwarding from wan to lan and lan to lan

RouterOS General
1

Hi!
I’ve some test domain that are connected to my external ip connection, on my mikrotik I’ve a rule that forwart that request to a local machine and it goes, but when from a local pc I try to connect using the external ip I can’t connect:

External PC → https://test.domain.it:9444 (https://1.2.3.4:9444) → 192.168.1.2:443 OK

PC from same LAN 192.168.1.230 → https://test.domain.it:9444 (https://1.2.3.4:9444) FAILS

My nat rule is:
add action=dst-nat chain=dstnat dst-port=9444 log=yes log-prefix=NAT protocol=tcp to-addresses=192.168.1.2 to-ports=443

and some log from the NAT rule:
10:29:51 echo: firewall,info NAT dstnat: in:ether5-LAN out:(unknown 0), src-mac 11:22:33:44:55:00, proto TCP (SYN), 192.168.111.240:35092->1.2.3.4:9444, len 60
10:29:51 echo: firewall,info NAT dstnat: in:ether5-LAN out:(unknown 0), src-mac 11:22:33:44:55:00, proto TCP (SYN), 192.168.111.240:35094->1.2.3.4:9444, len 60
10:29:51 echo: firewall,info NAT dstnat: in:ether5-LAN out:(unknown 0), src-mac 11:22:33:44:55:00, proto TCP (SYN), 192.168.111.240:35098->1.2.3.4:9444, len 60

2

Ok i Fix it using http://wiki.mikrotik.com/wiki/Hairpin_NAT

add action=masquerade chain=srcnat out-interface=ether5-LAN src-address=192.168.1.0/24

To fix troubles about ports I create a list of my external ip and force al rule nat to use it as destination:

/ip firewall address-list
add address=1.2.3.4/29 list=“External IP”
add address=5.6.7.8/29 list=“External IP”

nat rule change in:
add action=dst-nat chain=dstnat dst-address-list=“External IP” dst-port=9444 protocol=tcp to-addresses=192.168.1.2 to-ports=443