Port Forwarding with Dual WAN

RouterOS Beginner Basics
1

Hi All,

This is my first post on forum. Thanks to mikrotik we do have such a large platform of discussion over multiple scenarios and troubleshooting queries.

My query goes as below…

I have setup 2 mikrotik routers at my location.

1> 1st routerboard 2011 which is used to bond 2 different wan links which runs from different providers with live IP on both links. A LAN pool is set for my hotspot router purpose.

2> 2nd routerboard x86 system is used to setup hotspot+PPPoE service for my clients. An IP Address from LAN pool from 1st router is used as wan for this router.

Everything works fine. Bandwidth is load balanced between 2 WANs. But now the problem arise when i have to make some rules of port forwarding.

Complete Scenario:—

1st Router

1> Wan1 IP - 103.239.146.129/30
2> Wan 2 IP - 182.19.18.93/30
3> LAN Pool - 192.168.100.0/29

2nd Router

1> Wan IP - 192.168.100.2/29
2> LAN IP POOL - 172.16.20.0/22

Now one of my hotspot client uses CCTV camera and he wants to access it from outside. His IP is 172.16.22.254/22.
I created set of dst-nat rule in both router. 1st set of rule created in 1st router where i pointed WAN2 to local IP on different ports. 2nd set of rules created in 2nd router pointing wan to hotspot client IP on same ports used in 1st router.

for example flow goes like this

182.19.18.93:91 → 192.168.100.2:91 → 172.16.22.254:91

When i access wan 2 IP with port number 91 from outside network other than my hotspot , i used to get successful access on CCTV DVR on port 91. But when i tried to access 182.19.18.93 with port number 91 from my hotspot network, i get nothing. i cant reach CCTV DVR which is set on 172.16.22.254 with port number 91.

Please can anyone help me where the problem is and how to get it resolved?

Thanks,
Sanket Bijlani

Mikrotik Rocks!!

2

When on the hotspot, you’d need a hairpin NAT rule.
http://wiki.mikrotik.com/wiki/Hairpin_NAT

Your dst-nat port forwarding rule probably has an in-interface specified, so packets that originate inside the network destined for your 1rst router’s wan IP are being dropped because they don’t match any rule.

With Hairpin NAT, you have to alter not only the dst-address, but the src-address (so both dst-nat and src-nat). In the end, a hotspot user on the same subnet as the CCTV will have all his packets routed through the 1rst router…

Alternatively, you could specify a dns hostname for the CCTV. When external, DNS resolves to your WAN2 public IP. Then on both the 1rst and 2nd routers you can override the DNS with 192.168.100.2 on the 1st router and 172.xxx on the 2nd router. But then of course hotspot users must be using the router as a DNS server instead of public DNS..

For external connections to the CCTV, when connecting in on WAN2, the CCTV must send packets out WAN2 as well. If you’re using load balancing, then you probably have this setup already. If it’s not working, then somewhere, depending on the type of load balancing you used, there’ll be a setting to remember which interface a connection was established. This setting may be set to remember connections for outbound connections only.