Problem with Hairpin NAT

RouterOS Beginner Basics
1

Hi everybody,

I just installed RouterOS 6.4 on my Alix 6f2 and got almost everything working, except some little things.. eg. Hairpin NAT. I hope somebody could help me.

WAN: ether1 with DHCP Client (gets dyn. public IP from ISP)
LAN: “LAN-WLAN-Bridge” (192.168.10.0/24) bridges ether2 and wlan1

There is a Web/Mailserver (192.168.10.4) and I NAT’d HTTP, SMTP and IMAP ports to this host. Then I noticed that this Host is only reachable via WAN from outside the LAN and I found this Hairpin NAT-Thing :sunglasses:.. I added the src-NAT rule for the HTTP service but it doesnt work. Here are my NAT rules:

Flags: X - disabled, I - invalid, D - dynamic
 0   ;;; HTTP
     chain=dstnat action=dst-nat to-addresses=192.168.10.4 to-ports=80 protocol=tcp in-interface=ether1 dst-port=80

 1   chain=srcnat action=masquerade to-addresses=192.168.10.1 to-ports=80 protocol=tcp src-address=192.168.10.0/24 dst-address=192.168.10.4 out-interface=LAN-WLAN-Bridge dst-port=80

 2   ;;; SMTP
     chain=dstnat action=dst-nat to-addresses=192.168.10.4 to-ports=25 protocol=tcp in-interface=ether1 dst-port=25

 3   chain=dstnat action=dst-nat to-addresses=192.168.10.4 to-ports=465 protocol=tcp in-interface=ether1 dst-port=465

 4   chain=dstnat action=dst-nat to-addresses=192.168.10.4 to-ports=587 protocol=tcp in-interface=ether1 dst-port=587

 5   ;;; IMAP
     chain=dstnat action=dst-nat to-addresses=192.168.10.4 to-ports=143 protocol=tcp in-interface=ether1 dst-port=143

 6   chain=dstnat action=dst-nat to-addresses=192.168.10.4 to-ports=993 protocol=tcp in-interface=ether1 dst-port=993

 7   ;;; OpenVPN
     chain=dstnat action=dst-nat to-addresses=192.168.10.8 to-ports=1194 protocol=udp in-interface=ether1 dst-port=1194

 8   chain=srcnat action=masquerade out-interface=ether1

I followed the instructions at http://wiki.mikrotik.com/wiki/Hairpin_NAT

Any hints for me? :wink:

greets,

Karsten

2

#0 should probably be chain srcnat

Chain=src-nat, Dst. Address=mywanip, Protocol=TCP, Dst.Port=22, action=dst.nat, To Addresses=mylanserverip, To Ports=22
Chain=srcnat, Src. Address=mylanipscope,Dst. Address=mylanserverip, Protocol=TCP, Dst. Port=22, out-interface=lan-bridge, action=masquerade
3

Your dst-nat rules are only applied to ether1, you need to change your dst-nat rules to apply to all interfaces, or add a rule that dst-nat’s traffic coming from Lan-Wan-Bridge.