Port Forwarding

RouterOS Beginner Basics
1

I’ve had my mikrotik for a while but I’m struggling trying to host an old school game. The game I’m trying to play needs ports 2346, 2347, 2348 TCP and UDP. I added 2 NAT rules:

Chain - dstnat > Protocol - tcp > Dst port - 2346-2348 > In Int - ether1 > Action - dst-nat > To Addresses - IP of PC hosting game > To Ports - 2346-2348
Chain - dstnat > Protocol - udp > Dst port - 2346-2348 > In Int - ether1 > Action - dst-nat > To Addresses - IP of PC hosting game > To Ports - 2346-2348

Also added 2 filter rules
Chain - forward > protocol - tcp > dst port 2346-2348 > Connection NAT State - dstnat > Action - accept
Chain - forward > protocol - tcp > dst port 2346-2348 > Connection NAT State - dstnat > Action - accept

I can see the dstnat firewall log entry showing up when someone tries to connect to my server
dstnat: in:ether1 out:(unknown 0), src-mac XXXXXX, proto TCP (SYN), XXX.XXX.XXX.XXX:6711->XXX.XXX.XXX.XXX:2346, len 52

Added inbound and outbound rules to my windows defender firewall for ports 2346-2348, also tried disabling defender firewall completely to isolate this as an issue. Still can’t get anyone to connect to my PC hosting the server. Any help would on this would be great, I’m not sure my if I have my filter rules in the right spot on the list, but it seems it is trying to forward the connection to my PC.

2

Covers a wide range of port forwarding topics…
https://forum.mikrotik.com/viewtopic.php?t=179343

3

Not sure about this one, but something to look at. You are assuming that your rule:

Chain - dstnat > Protocol - udp > Dst port - 2346-2348 > In Int - ether1 > Action - dst-nat > To Addresses - IP of PC hosting game > To Ports - 2346-2348

will result in inbound packets to port 2346 will get forwarded to 2346 and 2347 will go to 2347, and lastly 2348 will go to 2348 because of your one rule. I’m not sure that part is correct. Inbound packets to any of the three port will get forwarded to one of the three ports, but not necessarily the same port. Fortunately there is an easy solution since you are not trying to change the ports. Just leave the to ports parameter out and it will forward to the same port that it came in to.

BTW, it is generally better to post the actual text of the rule rather than your paraphrase of it (editing whatever is needed for your security). Example:

add action=dst-nat chain=dstnat comment="NTP web interface." \
    dst-port=12380 in-interface=E10_Fiber_Internet protocol=tcp to-addresses=\
    192.168.123.123 to-ports=80

Note that in this rule, I am changing the port so I did have to specify the to-ports…