Port Forwarding Issue

RouterOS General
1

I am having some trouble with port forwarding and am not sure if it is related to load balancing or not…

I have three WAN connections, load balanced using PCC, and really just need to forward three ports on one of the WAN Ips to a local IP for a CCTV system.

If I use the following NAT:

/ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=srcnat action=masquerade out-interface=WAN1 log=no log-prefix="" 
 1    chain=srcnat action=masquerade out-interface=WAN2 log=no log-prefix="" 
 2    chain=srcnat action=masquerade out-interface=WAN3 log=no log-prefix="" 
 3    chain=dstnat action=dst-nat to-addresses=192.168.1.5 to-ports=80 protocol=tcp in-interface=WAN2 dst-port=80 log=no log-prefix=""

port 80 on the WAN2 correctly forwards to 192.168.1.5 - the Windows server (for testing). However if I change the entry to:

 3    chain=dstnat action=dst-nat to-addresses=192.168.1.38 to-ports=80 protocol=tcp in-interface=WAN2 dst-port=80 log=no log-prefix=""

it does not forward to 192.168.1.38, the CCTV web page, I have also tried forwarding to two printer webpages. It seems that it will always forward to 192.168.1.5, the Windows server, but changing it to NAT to any other IP fails. Is there something I may have missed elsewhere? I can’t understand why port forwarding would work for one internal IP, but fail on any other; the firewall rule is not set to a specific IP. Please see below:

/ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
      chain=input action=accept protocol=icmp log=no log-prefix="" 
1    ;;; default configuration
      chain=input action=accept connection-state=established,related log=no log-prefix="" 
 2   chain=forward action=accept protocol=tcp in-interface=WAN2 dst-port=80 log=no log-prefix="" 
 3   ;;; default configuration
      chain=input action=drop in-interface=WAN1 log=no log-prefix="" 
4    ;;; default configuration
      chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix="" 
 5   ;;; default configuration
      chain=forward action=accept connection-state=established,related log=no log-prefix="" 
6    ;;; default configuration
      chain=forward action=drop connection-state=invalid log=no log-prefix=""

Mangle below if helpful:

/ip firewall mangle print     
Flags: X - disabled, I - invalid, D - dynamic 
 0   chain=prerouting action=accept dst-address=192.168.1.0/24 in-interface=bridge-local log=no log-prefix="" 

 1   chain=input action=mark-connection new-connection-mark=WAN1-conn passthrough=no in-interface=WAN1 connection-mark=no-mark log=no log-prefix="" 

 2   chain=input action=mark-connection new-connection-mark=WAN2-conn passthrough=no in-interface=WAN2 connection-mark=no-mark log=no log-prefix="" 

 3   chain=input action=mark-connection new-connection-mark=WAN3-conn passthrough=no in-interface=WAN3 connection-mark=no-mark log=no log-prefix="" 

 4   chain=output action=mark-routing new-routing-mark=WAN1-conn passthrough=no out-interface=WAN1 connection-mark=WAN1-conn log=no log-prefix="" 

 5   chain=output action=mark-routing new-routing-mark=WAN2-conn passthrough=no out-interface=WAN2 connection-mark=WAN2-conn log=no log-prefix="" 

 6   chain=output action=mark-routing new-routing-mark=WAN3-conn passthrough=no out-interface=WAN3 connection-mark=WAN2-conn log=no log-prefix="" 

 7   chain=prerouting action=mark-connection new-connection-mark=WAN1-conn passthrough=yes dst-address-type=!local in-interface=bridge-local connection-mark=no-mark per-connection-classifier=both-addresses:3/0 log=no log-prefix="" 

 8   chain=prerouting action=mark-connection new-connection-mark=WAN2-conn passthrough=yes dst-address-type=!local in-interface=bridge-local connection-mark=no-mark per-connection-classifier=both-addresses:3/1 log=no log-prefix="" 

 9   chain=prerouting action=mark-connection new-connection-mark=WAN3-conn passthrough=yes dst-address-type=!local in-interface=bridge-local connection-mark=no-mark per-connection-classifier=both-addresses:3/2 log=no log-prefix="" 

10  chain=prerouting action=mark-routing new-routing-mark=WAN1-conn passthrough=no in-interface=bridge-local connection-mark=WAN1-conn log=no log-prefix=""

11  chain=prerouting action=mark-routing new-routing-mark=WAN2-conn passthrough=no in-interface=bridge-local connection-mark=WAN2-conn log=no log-prefix="" 

12  chain=prerouting action=mark-routing new-routing-mark=WAN3-conn passthrough=no in-interface=bridge-local connection-mark=WAN3-conn log=no log-prefix=""

Thanks in advance for any help!

EDIT: After searching more port forwarding posts I have seen to run Torch on the LAN, filtered to the local IP (in this case the printer). Tx Rate and Rx Rate both increase when I attempt to access from external so it looks like it is at least getting there and trying to get back. Not sure if it is failing to route back correctly for some reason.

2nd Edit: I have tried a couple of other addresses. The port forwarding works fine on .5, a server, and .21, a printer. It fails on .37, another printer, and .38, the CCTV. All of these, except for the server, are on DHCP, and all have correct network settings.

2

I have started looking at this again this morning, and when checking the Connections tab, and attempting to connect to the external ip on port 80 from outsaide the network, I see the connection mark as being set to WAN3-conn.

I assume this means that although the connection is coming in on WAN2, for some reason it is trying to go back out on WAN3, hence why it is failing.

Does this make sense, and if so what can I do to rectify it?

Many thanks.

3

Add more connection mark rules in the prerouting chain that match anything coming in WAN1, WAN2, etc - and mark connection accordingly there.
The existing mark-routing rules will work for these without any additional modifications.

4

Thank you so much! Your reply, combined with the information here has resolved the issue. I added:

add chain=prerouting in-interface=WAN1 action=mark-connection new-connection-mark=WAN1-conn
add chain=prerouting in-interface=WAN2 action=mark-connection new-connection-mark=WAN2-conn
add chain=prerouting in-interface=WAN3 action=mark-connection new-connection-mark=WAN3-conn

and now all is working as it should.

Thanks again!