Port Foward with PCC

PatricioMK24 · July 18, 2024, 12:22am

Hello! I was reading other posts on the forum on the topic of port forwarding but I couldn’t find a solution to my problem.

I have 2 WANs (one PPPoE and one DHCP). The PCC configuration is working fine, but I need port forwarding to be on WAN-6 (DHCP). The main connection is through WAN-1 (PPPoE).

This is my configuration:

ether1: WAN PPPoE
ether6: WAN DHCP

ether2 / 3: LAN Bridge

I also cannot connect to OpenVPN with Mikrotik itself being the server.

I need to Port Foward 10.10.0.9 PORT: 8101

ip route
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=33.33.33.1 routing-table=To_Telecentro \
    scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=ping disabled=no distance=1 dst-address=0.0.0.0/0 gateway=44.44.44.1 pref-src="" routing-table=\
    To_Movistar scope=30 suppress-hw-offload=no target-scope=10
    
    
/ip firewall mangle
add action=mark-connection chain=input in-interface=Movistar-pppoe new-connection-mark=Movistar_Conn passthrough=no
add action=mark-connection chain=input in-interface=ether6-Telecentro new-connection-mark=Telecentro_Conn passthrough=no
add action=mark-routing chain=output connection-mark=Movistar_Conn new-routing-mark=To_Movistar passthrough=no
add action=mark-routing chain=output connection-mark=Telecentro_Conn new-routing-mark=To_Telecentro passthrough=no
add action=mark-connection chain=prerouting connection-state=new dst-address=33.33.33.5 new-connection-mark=\
    Telecentro_Conn passthrough=yes protocol=tcp
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new in-interface=Movistar-pppoe \
    new-connection-mark=Movistar_Conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new in-interface=ether6-Telecentro \
    new-connection-mark=Telecentro_Conn passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new dst-address-type=!local \
    in-interface=LAN-Bridge new-connection-mark=Movistar_Conn passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0
add action=mark-connection chain=prerouting connection-mark=no-mark connection-state=new dst-address-type=!local \
    in-interface=LAN-Bridge new-connection-mark=Telecentro_Conn passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1
add action=mark-routing chain=prerouting connection-mark=Movistar_Conn in-interface=LAN-Bridge new-routing-mark=\
    To_Movistar passthrough=yes
add action=mark-routing chain=prerouting connection-mark=Telecentro_Conn in-interface=LAN-Bridge new-routing-mark=\
    To_Telecentro passthrough=yes


/ip firewall nat
add action=dst-nat chain=dstnat connection-mark=Telecentro_Conn dst-address=33.33.33.5 dst-port=8101 protocol=tcp \
    to-addresses=10.10.0.9 to-ports=8101
add action=masquerade chain=srcnat out-interface=Movistar-pppoe
add action=masquerade chain=srcnat out-interface=ether6-Telecentro

sindy · July 18, 2024, 7:37am

Try reading this post, starting from the last paragraph that links it to your context. If it does not help resolve your case, say so here, we shall proceed with your particular configuration.

PatricioMK24 · July 22, 2024, 1:20pm

Hello Sindy!

I already found the problem. It was a bad configuration of the firewall filters regarding ICMP. DROP all packages.

I’m reviewing the rules to make an optimal setup. When I have it defined, I’ll pass it on.

Thanks!!!

anav · July 22, 2024, 4:13pm

Certainly dont want to drop ICMP its used for good reasons.

Conceptually speaking Discussing Port FORWARDING IN GENERAL
In terms of PCC plus port forwarding.
Consider that PCC forces LAN traffic to specific WANIPs and you have no real control over which sessions.
Therefore, one has to ensure that server traffic is taken care of FIRST.
There are several ways to accomplish this.

In any case it would be logical to create a firewall address list for all the servers in question
/ip firewall address-list
add address=server1 list=SERVERS
add address=server2 list=SERVERS
etc.

FACT: —> ENSURE Server Traffic is handled prior to PCC traffic in mangle rules.

We have to consider 3 types of server users.
a. those local using LANIP directly
b. those local using DYNDNS name of server
c. those coming in external to the router.

This rule first in the mangle chain takes any outgoing traffic from the servers and allows it to happen.
Thus this is a good logic start as apparently we would no longer worry about the traffic being PCCd.
add action=accept chain=forwarding src-address-list=SERVERS

However, do you see any issues with this rule used in isolation, running through the 3 scenarios above?
What if the external user request came in on WAN2, but WAN1 is the primary route on the router.
So for external traffic we still have to consider Routing. Thus we cannot avoid mangling for servers, seems to be the outcome:

The proposed solution is a joint effort of the two
/ip firewall mangle
{ for direct LAN user to server traffic - avoiding mangling by PCC }
add chain=forward action=accept in-interface-list=LAN dst-address-list=SERVERS
add chain=forward action=accept src-address-list=SERVERS out-interface-list=LAN
+++++++++++++
{ ENSURING EXTERNAL TRAFFIC COMING IN ON WANX HEADING FOR SERVERS goes out WANX }
add chain=forward action=mark-connection connection-mark=no-mark interface=ether1(wan1)
new-connection-mark=incoming-WAN1 passthrough=yes
add chain=forward action=mark-connection connection-mark=no-mark interface=ether2(wan2)
new-connection-mark=incoming-WAN2 passthrough=yes
+++++
add chain=prerouting action=mark-routing connection-mark=incoming-WAN1
src-address-list=SERVERS new-routing-mark=To_Movistar passthrough=no
add chain=prerouting action=mark-routing connection-mark=incoming-WAN2
src-address-list=SERVERS new-routing-mark=To_Telecentro passthrough=no

Notes:

NOW YOU CAN ADD PCC MANGLES AFTER THE ABOVE.
I see you have already mangle input/output rules, so assuming you have services on the router VPNs?? etc that need to respond on correct WAN??
They probably should remain first in the order of Mangle Rules. Whats important is above is before PCC rules.
I configged both WAN1 and WAN2 for the port forwarding mangling because it is not clear if ALL servers go through WAN2 and none through WAN1 or a mix.
If only WAN2 is used then by all means ignore the WAN1 part. I highlighted WAn2.