port forwarding (stream game server behind mikrotik) confusing

RouterOS Beginner Basics
1

Hello,

I have problem define port forwarding to open my local PC machine for friends to play steam games through internet.
I have just two PC’s (my game PC and dedicated server for steam game servers (ether2 and 3).
My public internet IP (changed) is 10.10.10.10 (external gateway and DNS is 10.10.10.1) and connected to ether1.
Local IP for server PC is 192.168.88.109

I add this:
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=10.10.10.10 dst-port=3000 protocol=udp to-addresses=192.168.88.109 to-ports=3000
add action=dst-nat chain=dstnat dst-address=10.10.10.10 dst-port=3001 protocol=tcp to-addresses=192.168.88.109 to-ports=3001
add action=dst-nat chain=dstnat dst-address=10.10.10.10 dst-port=“” port=88,500,3074,3544,4500,8777 protocol=udp to-addresses=192.168.88.109
or
add action=dst-nat chain=dstnat dst-address=10.10.10.10 port=88,500,3074,3544,4500,8777 protocol=udp to-addresses=192.168.88.109

But this doesn’t work. I’m even not sure I can use this way if my mikrotik is in ROUTER mode (defined in quick set)

With older DSL modem I just add another rule to port forwarding and everything work fine. Since I moved from ADSL internet provider to new one with RB4011iGS+ on my site, I’m unable understand what i’m doing wrong.
Anyone can point me right direction please?

There is whole configuration export (default router config without modification excemt /nat changes.

# 2024-11-15 15:11:00 by RouterOS 7.16.1
# model = RB4011iGS+
/interface bridge
add admin-mac=D4:01:C3:2E:EC:16 auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.150-192.168.88.254
/port
set 0 name=serial0
set 1 name=serial1
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge disabled=yes interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.88.1/24 interface=bridge network=192.168.88.0
/ip dhcp-client
add comment=defconf interface=ether1
/ip dhcp-server
add address-pool=dhcp interface=bridge name=defconf
/ip dhcp-server network
add address=0.0.0.0/24 comment=defconf dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=10.10.10.1
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-address=10.10.10.10 dst-port=3000 protocol=udp to-addresses=192.168.88.109 to-ports=3000
add action=dst-nat chain=dstnat dst-address=10.10.10.10 dst-port=3001 protocol=tcp to-addresses=192.168.88.109 to-ports=3001
add action=dst-nat chain=dstnat dst-address=10.10.10.10 port=3074,8777 protocol=tcp to-addresses=192.168.88.109
add action=dst-nat chain=dstnat dst-address=10.10.10.10 dst-port="" port=88,500,3074,3544,4500,8777 protocol=udp to-addresses=192.168.88.109
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system routerboard settings
set enter-setup-on=delete-key
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
2

The main issue is the WANIP, what is it static or dynamic??? see 6.

  1. Get rid of this empty line.
    /ip dhcp-server network
    add address=0.0.0.0/24 comment=defconf dns-server=0.0.0.0 gateway=0.0.0.0 netmask=24
    add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 netmask=24

  2. You can remove this default static IP DNS rule.
    /ip dns static
    add address=192.168.88.1 comment=defconf name=router.lan type=A

  3. What is DNS 10.10.10.1 ??? it seems close to the IP address of you ISP?
    I see that you have IP DHCP client selected. If your intention with the above DNS setting was to use the ISP offered DNS,
    then in IP DHCP client simply select USE PEER DNS and remove the IP DNS entry as its not required.
    If your intent is not use ISP DNS, the DO NOT select use peer dns and keep the IP DNS entry except change DNS to something like 1.1.1.1

  4. Recommend changing this rule to something a bit better for security and clearer!!
    add action=drop chain=forward comment=“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
    TO
    add action=accept chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
    add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat
    add action=drop chain=forward comment=“drop all else”

  5. From ( mac-server by itself is not a secure method for winbox access )
    /tool mac-server
    set allowed-interface-list=LAN
    /tool mac-server mac-winbox
    set allowed-interface-list=LAN
    TO:
    /tool mac-server
    set allowed-interface-list=NONE
    /tool mac-server mac-winbox
    set allowed-interface-list=LAN

  6. What I am having trouble understanding is the fact that you state that the WANIP is a public and fixed/static IP.
    However you have IP DHCP Client selected, which indicates that the WANIP is dynamic.
    But you have dstnat rule that seem to indicate its a fixed static public WANIP.

A. If it is a public static / fixed, then use IP address wiith interface ether1 to terminate the connection and GET RID OF Ip dhcp client!!



B. If it is a public dynamic IP, then keep IP DHCP client but you will need to change the dstnat rules.
For future proofing recommend the following.

/ip firewall address-list
add address=****mynetname.net list=MyWAN comment=“dyndns URL from IP Cloud settings”

add action=dst-nat chain=dstnat dst-address-list=MyWAN port=88,500,3074,3544,4500,8777 protocol=udp to-addresses=192.168.88.109
add action=dst-nat chain=dstnat dst-address-list=MyWAN dst-port=3001 protocol=tcp to-addresses=192.168.88.109

3

Hello,

My public IP is static.

btw: I need more time to read and understand all you post in response.

Thank you.

4

Hello,

After I entered this line:
add action=drop chain=forward comment=“internet traffic” in-interface-list=LAN out-interface-list=WAN
I can’t connect too any external IP’s (ie I can’t open any web site)

And about DNS 10.10.10.1 - I mean this is public static IP provider’s gateway and his DNS server.

5

CGNAT ?

6

Were you ever able to port forward games from your ISP, on this or a previous router??

Quick check, do these results provide the same answer.

  1. Browser check → whats my IP = ???
  2. IP cloud check >>> public IP = ???
  3. IP DHCP client if used —>IP address = ???
    or
    Assigned static IP address = ???
7

No idea what you asking for.

8

Yes and yes.
Tested many private servers (with previous DSL modem). Everything worked fine.
And yes, I have static + public IP (verified).

9

Super and my bad on the rule it was supposed to be accept.
add chain=forward action=accept comment="internet traffic in-interface-list=LAN out-interface-list=WAN

Post latest rendition of config and I will relook;

10

Hi @Vladimir22

Check out wiki:

It’s the isp way of nat aswell like you.

What “public” ip do you have ??
Is the range like this
https://datatracker.ietf.org/doc/html/rfc6598#section-7
https://en.wikipedia.org/wiki/Carrier-grade_NAT