Port forwarding question with some twists

RouterOS Beginner Basics
1

Question;
I’m not on my feet yet with Dude and Mikrotik CLI so what I would like is a way to get into a remote office Hex webfig through a Cloud Hosted RouterOS LAN IP. I thought I could do some basic port forwarding in the CHR LAN to the remote Hex Wireguard virtual IP but it isn’t working, what am I doing wrong?

I’m not sure if this NAT rule in CHR is correct;

General;
Chain; dstnat
Protocol; tcp
dst port; 24701 (I randomly picked some unused IANA space)
In interface list; all
Action
Action; dst-nat
to address; 10.50.1.1
to port; 80 (also tried 443, has a cert and is enabled in the hex)

Error; http://192.168.140.130:24701 == ERR_CONNECTION_TIMED_OUT

Situation;
I have a central Cloud Hosted RouterOS, that hosts wireguard VPN and Dude server. This has public static IP I can work with, and the CHR itself sits on a LAN IP behind our data center main firewall.
Remote office has a Hex behind a firewall I don’t control and dynamic IP. This is connecting via wireguard back to central Router OS and they can ping each other via the wireguard virtual IP. Also CHR Dude server can connect to the remote Hex via that wireguard virtual IP.

Remote Hex has a firewall rule allowing this;

Comment; Allow Config over VPN
Chain; input
Src Address; 10.0.0.0/8 (covers both OpenVPN running on 10.8.0.x and should cover Wireguard on 10.50.0.x)
Protocol; tcp
Dst port; 80,443,8291
Two comments on this rule;
-Dude can reach this router over the Wireguard VPN from CHR, dude is looking at address 10.50.1.1
-Also Openvpn connection from this router to another system that I can reach the webfig in this Hex over that OpenVPN 10.8.0.14 virtual address.

CHR firewall rule

Comment; Allow Config over LAN
chain; input
src address; 192.0.0.0/8 (I can reach this webfig over our office LAN, but not internet == good)
protocol; tcp
dst port; 80,443,8291,24700-24800 (I modified this and added the high numbers, I randomly picked some unused IANA space)
action; acept

Basic Ping testing between CHR and remote Hex looks good to me;

[user@remoteRouterOS] > ping 10.50.1.254   (this is the wireguard interface in the CHR)
  SEQ HOST                                     SIZE TTL TIME       STATUS                                                                                                                       
    0 10.50.1.254                                56  64 27ms818us 
    1 10.50.1.254                                56  64 27ms233us 
    2 10.50.1.254                                56  64 27ms876us

Inside the CHR it can reach out through wireguard to ping the Hex and Dude can use this to read the remote Hex router.

[user@CHR] > ping 10.50.1.1 
  SEQ HOST                                     SIZE TTL TIME       STATUS                                                                                                                                                                                                                            
    0 10.50.1.1                                  56  64 26ms876us 
    1 10.50.1.1                                  56  64 27ms33us  
    2 10.50.1.1                                  56  64 27ms192us
2

Without the config of both sites it’s hard to judge but it seems to me like a routing issue on the remote site. More specifically, a missing route for return traffic. However, it would be easier to troubleshoot by posting the aforementioned configs by using the following command:

/export file=anynameyouwish

and opening it with any text editor to obfuscate sensitive information like serial numbers, public IPs, passwords, etc.

3

I’m struggling with that bit myself, the remote Hex would be replying to the CHR or trying to get straight back to the end user browser in this case?

CHR config;
chr.rsc (2.9 KB)

Remote Hex config;
remotehex.rsc (5.2 KB)

4

sorry posted in wrong thread.

5

The data center firewall has public static IP and basic port forwarding for 1194 to the Mikrotik CHR. Wireguard is using that.

The remote Hex appears to be connected to the CHR fine, they can ping each other in the wireguard 10.50.x.x addresses. Also Dude in the CHR can see the remote Hex router.

6

Only as a side note, it is (IMHO) easier/simpler to add the wireguard interface as LAN in /interface list member, or allow the wirguard interface as opposed to add specific source address rule in the firewall, see:

7

Thank you, I could definitely make that better.

8

In the Allowed IPs of the remote hEX Wireguard include the 192.168.140.0/24 network and add the following route:

/ip route
add dst-address=192.168.140.0/24 gateway=wireguardMGMT

You also need to have at least one more port forwarded to the CHR, e.g. the obscure one you use (24701), because two services can’t use the same port, as a conflict will arise

9

Dear @anav , I think you edited the wrong post

10

I don’t understand your last comment? My plan was to use 24701 for this particular remote Hex, 24702 for the next one etc.

Edit; and the results were the same, connection timeout. Also that firewall rule in the remote hex saw no traffic at all. For testing now I’m coming into the CHR via http://192.168.140.130:24701/ on a computer on the same subnet.

Right, this is what I wound up with;

[admin@MikroTik-wci44-client4] /ip/route> add dst-address=192.168.140.0/24 gateway=wireguardMGMT 
[admin@MikroTik-wci44-client4] /ip/route> print                                                  
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, s - STATIC, d - DHCP, v - VPN
Columns: DST-ADDRESS, GATEWAY, ROUTING-TABLE, DISTANCE
#     DST-ADDRESS       GATEWAY          ROUTING-TABLE  DISTANCE
  DAd 0.0.0.0/0         192.168.100.254  main                  1
  DAv 10.0.1.0/24       10.8.0.1         main                  1
  DAc 10.8.0.0/24       ovpn-prod        main                  0
  DAc 10.50.1.0/24      wireguardMGMT    main                  0
  DAv 10.144.102.0/24   10.8.0.1         main                  1
  DAv 10.144.103.0/24   10.8.0.1         main                  1
  DAc 10.144.104.0/24   bridge           main                  0
  DAv 10.144.105.0/24   10.8.0.1         main                  1
  DAc 192.168.100.0/24  ether1           main                  0
0  As 192.168.140.0/24  wireguardMGMT    main                  1

Firewall rule

Comment; Allow Config over VPN
Chain; input
Src Address; 192.168.140.0/24
Protocol; tcp
Dst Port; 80,443,8291
11

I meant in the peer settings:

/interface wireguard peers
set peer1 allowed-address=10.50.1.0/24,192.168.140.0/24
12

OK, now it’s working, Thank you, that was a big help!