Port mapping with WebFig 5.25

RouterOS Beginner Basics
1

I’m new to MikroTik - and am trying to put some webcams to ports on the router. I can connect to them fine inside the network, but from outside I can see packets coming in but noting appears to be going out. I’m using webfig and followed the rule for port mapping in the manual “Firewall / NAT”. These are the lines I have edited for one of the cams (D-Link DCS-930L):

Chain dstnat
Protocol 6 (tcp)
Dst. Port 808
Action dst-nat
To Addresses 192.168.88.87
To Ports 808

The manuals gives this example for a port map and I think I have everything covered in WebFig:
/ip firewall nat add chain=dstnat dst-port=1234 action=dst-nat protocol=tcp to-address=192.168.1.1 to-port=1234

My port I want to use is 808 for this one cam, and the webcam is set up on 192.168.88.87:808. When I access it from outside I can see the bytes and packets count increment in WebFig - but no connection happens. Inside I have no problems. I’m new to MikroTik and this seems like it should be straightforward. My old Linksys router was a simple fill in the blank for NAT, I know the MikroTik is much more complex. I don’t want to set up a source IP as that could change, and the example shows it is not necessary. What am I doing wrong? Thanks, Mike

2

hi!

for me it looks, that your rule lacks either dst-address or in-interface. otherwise it requests that ANY traffic passing through your router (to port 808) needs to be NATed.

also, are you checking if the rule works from outside of the network or from inside ? as far as i know, NAT is done “on the external edge” - so, your NAT rules should not be working on bridge interface ports (traffic passes no external edge, and is transparent for router).

and next question - does your webcam know of default gateway ? :slight_smile: are src-nat/masquerade rules in place ?

3

You should specify a source address of your public ip or an in interface because your dear-NAT rule would match more traffic then you would expect.


Joshaven Potter
http://joshaven.com
Sent from my iPhone using Tapatalk