Hi, sorry to post this question yet again, but I’ve read through a bunch of posts, tried different things, but I can not get this to work:
I have a RB4011 and a Zyxel PMG3000 GPON SFP-Module. It works fine, GPON gets internet access and passes it to the RB4011.
Now I’m trying to add some port forwarding, and just can not get this to work, whatever I tried.
I mostly followed instructions mentioned in these posts:
- https://www.steveocee.co.uk/mikrotik/port-forwarding/
- https://github.com/ViToni/mikrotik-router-setup?tab=readme-ov-file#port-forwarding
So, I enabled IP Cloud, added the host in the Address list, so it resolves it dynamically. Then added the NAT rules with that address list. Added the Hairpin NAT rule as the first rule in the list, followed by the NAT rule, and then the port forwarding rules. I tried with different ports in case the ISP was somehow blocking 80 and 443, but it made no difference.
It works inside the network, but not from the outside. I’ve tried scanning the public ip with canyouseeme.org and similar tools, it shows no opened ports. I can’t access it in any way, directly by ip, ip cloude domain, duckdns domain… All of them work inside the network.
Here is almost my full config, I just removed the needless things like dhcp leases, duck dns script and similar. Can someone please have a look, what am I missing? Is my config missing something, or is it really the ISP blocking all forwarding (can they even do that?)
[admin@Router] > export
# mar/14/2025 17:45:29 by RouterOS 6.49.18
# software id = QT32-M0RU
#
# model = RB4011iGS+5HacQ2HnD
# serial number = HD8080GG46Y
/caps-man channel
add band=5ghz-n/ac name=5G
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled frequency=2412,2437 name=2.4G save-selected=no
add band=2ghz-onlyn control-channel-width=20mhz extension-channel=disabled frequency=2412,2437 name="2.4G Fast" save-selected=no
/interface bridge
add admin-mac=18:FD:74:C0:76:35 auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface wireless
# managed by CAPsMAN
# channel: 5180/20-Ceee/ac/P(20dBm)+5290/80/DP(17dBm), SSID: shljica-5g, CAPsMAN forwarding
set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX country=croatia distance=indoors frequency=auto installation=indoor mode=ap-bridge secondary-frequency=auto ssid="nemam pojma 5g" wireless-protocol=802.11
# managed by CAPsMAN
# channel: 2437/20/gn(17dBm), SSID: shljica, CAPsMAN forwarding
set [ find default-name=wlan2 ] band=2ghz-b/g/n channel-width=20/40mhz-XX country=croatia distance=indoors frequency=auto installation=indoor mode=ap-bridge ssid="nemam pojma 2g" wireless-protocol=802.11
/interface ethernet
set [ find default-name=sfp-sfpplus1 ] speed=1Gbps
/interface vlan
add interface=bridge name=vlan-guest vlan-id=40
add interface=bridge name=vlan-iot vlan-id=11
add interface=sfp-sfpplus1 name=vlan-isp-internet vlan-id=60
add interface=bridge name=vlan-main vlan-id=30
add interface=bridge name=vlan-media vlan-id=20
add interface=bridge name=vlan-mgmt vlan-id=88
add interface=bridge name=vlan-not vlan-id=10
add interface=bridge name=vlan-server vlan-id=2
/caps-man datapath
add bridge=bridge client-to-client-forwarding=no name="Guest Datapath" vlan-id=40 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes name="NoT Datapath" vlan-id=10 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes name="Media Datapath" vlan-id=20 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes name="Main Datapath" vlan-id=30 vlan-mode=use-tag
add bridge=bridge client-to-client-forwarding=yes name="IoT Datapath" vlan-id=11 vlan-mode=use-tag
/caps-man security
add authentication-types=wpa-psk,wpa2-psk name="Main Security Config"
add authentication-types=wpa-psk,wpa2-psk name="IoT Security Config"
add authentication-types=wpa-psk,wpa2-psk name="NoT Security Config"
add authentication-types=wpa-psk,wpa2-psk name="Media Security Config"
add authentication-types=wpa-psk,wpa2-psk name="Guest Security Config"
/caps-man configuration
add channel=5G country=croatia datapath="Main Datapath" name="Main 5g" security="Main Security Config" ssid=shljica-5g
add channel="2.4G Fast" country=croatia datapath="Main Datapath" name="Main 2g" security="Main Security Config" ssid=shljica
add channel=2.4G country=croatia datapath="IoT Datapath" datapath.local-forwarding=no name="IoT 2g" security="IoT Security Config" ssid=shljica-iot
add channel=2.4G country=croatia datapath="NoT Datapath" datapath.local-forwarding=no name="NoT 2g" security="NoT Security Config" ssid=shljica-not
add channel="2.4G Fast" country=croatia datapath="Media Datapath" datapath.local-forwarding=no name="Media 2g" security="Media Security Config" ssid=shljica-media
add channel=2.4G country=croatia datapath="Guest Datapath" datapath.local-forwarding=no name="Guest 2g" security="Guest Security Config" ssid=gostiona
add channel=5G country=croatia datapath="Media Datapath" name="Media 5g" security="Media Security Config" ssid=shljica-media-5g
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add include=LAN,WAN name="LAN & WAN"
add name="VLANs with Internet"
add name="VLANs without Internet"
add include="VLANs with Internet,VLANs without Internet" name=VLANs
add name="Server & Media"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp-pool ranges=192.168.88.10-192.168.88.254
add name=iot-dhcp-pool ranges=192.168.11.10-192.168.11.254
add name=not-dhcp-pool ranges=192.168.10.10-192.168.10.254
add name=server-dhcp-pool ranges=192.168.2.10-192.168.2.254
add name=media-dhcp-pool ranges=192.168.20.10-192.168.20.254
add name=main-dhcp-pool ranges=192.168.30.10-192.168.30.254
add name=guest-dhcp-pool ranges=192.168.40.10-192.168.40.254
/ip dhcp-server
add address-pool=default-dhcp-pool interface=vlan-mgmt name=mgmt-dhcp-server
add address-pool=iot-dhcp-pool disabled=no interface=vlan-iot lease-time=4w2d name=iot-dhcp-server
add address-pool=not-dhcp-pool disabled=no interface=vlan-not lease-time=4w2d name=not-dhcp-server
add address-pool=server-dhcp-pool disabled=no interface=vlan-server lease-time=3d name=server-dhcp-server
add address-pool=guest-dhcp-pool disabled=no interface=vlan-guest lease-time=30m name=guest-dhcp-server
add address-pool=main-dhcp-pool disabled=no interface=vlan-main lease-time=1d name=main-dhcp-server
add address-pool=media-dhcp-pool disabled=no interface=vlan-media lease-time=3d name=media-dhcp-server
add address-pool=default-dhcp-pool disabled=no interface=bridge name=deconf
/user group
add name=homeassistant policy=read,test,api,!local,!telnet,!ssh,!ftp,!reboot,!write,!policy,!winbox,!password,!web,!sniff,!sensitive,!romon,!dude,!tikapp
/caps-man manager
set enabled=yes
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=bridge
add disabled=no
add disabled=no
add disabled=no
add disabled=no
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=ac,an master-configuration="Main 5g" name-format=prefix-identity name-prefix=5g slave-configurations="Media 5g"
add action=create-dynamic-enabled hw-supported-modes=gn,g master-configuration="Main 2g" name-format=prefix-identity name-prefix=2g slave-configurations="IoT 2g,NoT 2g,Media 2g,Guest 2g"
/interface bridge port
add bridge=bridge comment="Hassio - vlan-server (2)" interface=ether2 pvid=2
add bridge=bridge comment="Switch.Basement - trunk" interface=ether3
add bridge=bridge comment=Empty interface=ether4
add bridge=bridge comment="Living Room TV IPTV - vlan-media (20)" interface=ether5 pvid=20
add bridge=bridge comment="Living Room TV Internet - vlan-media (20)" interface=ether6 pvid=20
add bridge=bridge comment="Office Right Wall - vlan-main (30)" interface=ether7 pvid=30
add bridge=bridge comment="Office Left Wall - vlan-main (30)" interface=ether8 pvid=30
add bridge=bridge comment="CAP.Bottom - trunk" interface=ether9
add bridge=bridge comment="CAP.Top - trunk" interface=ether10
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether3,ether9,ether10 vlan-ids=40
add bridge=bridge tagged=bridge,ether3,ether9,ether10 vlan-ids=11
add bridge=bridge tagged=bridge,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10 vlan-ids=88
add bridge=bridge tagged=bridge,ether3,ether9,ether10 vlan-ids=30
add bridge=bridge tagged=bridge,ether3,ether9,ether10 vlan-ids=2
add bridge=bridge tagged=bridge,ether3,ether9,ether10 vlan-ids=10
add bridge=bridge tagged=bridge,ether3,ether9,ether10 vlan-ids=20
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf disabled=yes interface=ether1 list=WAN
add interface=vlan-iot list="VLANs with Internet"
add interface=vlan-main list="VLANs with Internet"
add interface=vlan-media list="VLANs with Internet"
add interface=vlan-server list="VLANs with Internet"
add interface=vlan-not list="VLANs without Internet"
add interface=vlan-guest list=LAN
add interface=vlan-iot list=LAN
add interface=vlan-mgmt list=LAN
add interface=vlan-media list=LAN
add interface=vlan-not list=LAN
add interface=vlan-main list=LAN
add interface=vlan-server list=LAN
add interface=vlan-guest list="VLANs with Internet"
add interface=vlan-media list="Server & Media"
add interface=vlan-server list="Server & Media"
add interface=vlan-mgmt list="Server & Media"
add interface=vlan-isp-internet list=WAN
add disabled=yes interface=sfp-sfpplus1 list=WAN
/interface wireless cap
#
set bridge=bridge discovery-interfaces=bridge enabled=yes interfaces=wlan1,wlan2
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
add address=192.168.11.1/24 comment=iot interface=vlan-iot network=192.168.11.0
add address=192.168.10.1/24 comment=not interface=vlan-not network=192.168.10.0
add address=192.168.2.1/24 comment=server interface=vlan-server network=192.168.2.0
add address=192.168.20.1/24 comment=media interface=vlan-media network=192.168.20.0
add address=192.168.30.1/24 comment=main interface=vlan-main network=192.168.30.0
add address=192.168.40.1/24 comment=guest interface=vlan-guest network=192.168.40.0
add address=192.168.88.1/24 comment=management interface=vlan-mgmt network=192.168.88.0
add address=10.10.1.2/24 comment="SFP Module UI" disabled=yes interface=sfp-sfpplus1 network=10.10.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf interface=ether1
add comment="SFP Module Internet" disabled=no interface=vlan-isp-internet
/ip dhcp-server network
add address=192.168.2.0/24 comment=server gateway=192.168.2.1
add address=192.168.10.0/24 comment=not gateway=192.168.10.1
add address=192.168.11.0/24 comment=iot gateway=192.168.11.1
add address=192.168.20.0/24 comment=media gateway=192.168.20.1
add address=192.168.30.0/24 comment=main gateway=192.168.30.1
add address=192.168.40.0/24 comment=guest gateway=192.168.40.1
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,4.4.4.4
/ip dns static
add address=192.168.88.1 comment=defconf name=router.local
add address=192.168.2.50 regexp=".+\\.local\$"
/ip firewall address-list
add address=hd8080gg46y.sn.mynetname.net list=WAN-IP
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=input comment="Allow established, related, and untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="Allow established, related, and untracked" connection-state=established,related,untracked
add action=accept chain=input comment="Allow ICMP" protocol=icmp
add action=drop chain=input comment="Drop invalid traffic" connection-state=invalid
add action=drop chain=forward comment="Drop invalid traffic" connection-state=invalid
add action=accept chain=input comment="Allow local loopback (CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Allow local CAP (CAPsMAN)" dst-address-type=local src-address-type=local
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=accept chain=forward comment="Allow internet access to VLANs with Internet" in-interface-list="VLANs with Internet" out-interface-list=WAN
add action=accept chain=forward comment="Drop internet access to VLANs without Internet" in-interface-list="VLANs without Internet" out-interface-list=WAN
add action=drop chain=forward comment="iot-vlan: Only allow to communicate with vlan-mgmt" in-interface=vlan-iot out-interface=!vlan-mgmt
add action=accept chain=forward comment="main-vlan: Allow access from vlan-media SMB" in-interface=vlan-media out-interface=vlan-main
add action=accept chain=forward comment="main-vlan: Allow access from vlan-media SMB" in-interface=vlan-main out-interface=vlan-media
add action=drop chain=forward comment="guest-vlan: Only allow to communicate with vlan-mgmt" in-interface=vlan-guest out-interface=!vlan-mgmt
/ip firewall nat
add action=masquerade chain=srcnat comment="ONT UI masquerade" disabled=yes dst-address=10.10.1.1 out-interface=sfp-sfpplus1
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=192.168.0.0/16 src-address=192.168.0.0/16 to-addresses=192.168.2.100
add action=masquerade chain=srcnat comment=NAT ipsec-policy=out,none out-interface-list=WAN src-address=192.168.0.0/16
add action=dst-nat chain=dstnat comment="Forward DDNS port 80 to reverse proxy" dst-address-list=WAN-IP dst-port=80 protocol=tcp to-addresses=192.168.2.50 to-ports=80
add action=dst-nat chain=dstnat comment="Forward DDNS port 443 to reverse proxy" dst-address-list=WAN-IP dst-port=443 protocol=tcp to-addresses=192.168.2.50
add action=masquerade chain=srcnat comment="Samsung TV masquerade https://github.com/home-assistant/core/issues/35049#issuecomment-1290899760" dst-address=192.168.20.50 out-interface=vlan-media src-address=192.168.2.10
/system clock
set time-zone-name=Europe/Zagreb
/system identity
set name=Router
/system leds
add interface=wlan2 leds=wlan2_signal1-led,wlan2_signal2-led,wlan2_signal3-led,wlan2_signal4-led,wlan2_signal5-led type=wireless-signal-strength
add interface=wlan2 leds=wlan2_tx-led type=interface-transmit
add interface=wlan2 leds=wlan2_rx-led type=interface-receive