Port forwarding using dst-nat not working

[Julionf]

@robtor, thanks for the response!

For my side I don't see a problem here. I have almost the same configuration. The only differences are that I have the forwarding rules for dstnat not restricted to a specific port beacuse the nat rules would limit the incoming port range.

That makes sense, adapting my rules to it.

Another difference I have is that I have dst-nat rules not matching on the incoming interface/interface list, more I have a matching destination address lists which i dynamically update from my domain entry (no fixed public ipv4). (See Port forwarding: dst-address vs in-interface-list for this issue.)

This is a great idea, feels way more secure. Gonna do that as well, thanks for the suggestion.

Another thing to consider is whether you try to access your ports from inside or outside your network. If you check from inside, you might need a loopback nat rule / hairpin nat rule for access
(see NAT - RouterOS - MikroTik Documentation).

Yeah, I was looking at Hairpin NAT but couldn't understand if that was required for my case or not, anyway, my server is in a different subnet (10.0.10.0/24) than my PC where I'm checking the port access (192.168.96.0/24), how would Hairpin NAT work in this case?

---

@anav, also thank you for the answer!

You have allowed full access of every subnet to the router, so what is the point of the second rule which by the way will NEVER be triggered in this setup.

Yes, this was a mistake of mine, I did it this way following the Using RouterOS to VLAN your network tutorial, but I was supposed to make this rule more strict. I left it as is to allow my vlans to access DNS info from router, but forgot to change ... Anyway, the address list for Authorized IPs to access router is a great idea, gonna use that.

add action=accept chain=forward comment="Caddy to IoT" src-address=10.0.10.3 dst-address=10.0.20.1.0/24 dst-port=8123 protocol=tcp

I'm curious, is using

dst-address

here more secure than using

in-interface-list=WLAN

, since both would be targetting the same devices?

\

For me to see the port open using tools such as Port Forwarding Tester, should Caddy live in the same subnet of the device I'm accessing the tool?