Server access from within LAN but using WAN IP address

RouterOS General
1

Hi all,

I deploy Mikrotik routers in SOHO environments and a problem I come across frequently, which I have been meaning to find a solution for some time, is where a customer has a Smartphone App to access an internal service (server PC) on their network. The senario is usually this:

1 x fixed public WAN IP (usually on PPPOE interface) for internet access to ISP
1 x DHCP /24 Private LAN with any internal server PC’s made static IP’s on LAN
1 x srcnat from LAN to WAN (usually Masquerade all out of WAN)
1 x NAT dst-nat rule to forward Dst.Port to the server PC e.g.for Unifi smartphone app to reach Unifi server on LAN:
chain=dstnat action=dst-nat to-addresses=192.168.90.198 to-ports=8443
protocol=tcp dst-port=8443 log=no log-prefix=“”

Now when the phone app access settings are completed with the WAN public IP, the access to the service works from any external location (on 3g/4g mobile network for example - remote access works), but when the smart phone is on the LAN (using wifi in the same office) there is no access.

As a work-around I can change the phone app settings to the LAN address of the server when using wifi at the server location, but this is not a convenient answer.

What do I need to do to allow the WAN IP address settings to communicate with the server when the users mobile device is connected on the LAN?

Many thanks

Steve

2

Look into Hairpin NAT

3

Hi, quick question… are you trying to reach the APP using any DNS service in the middle? If not, try to add a new NAT rule, instead of using masquerade with an out-interface, you can use a src-nat, by matching the server dst-address.

4

The Hairpin NAT was the answer. I’ve added this NAT rule:

chain=srcnat action=masquerade protocol=tcp src-address=192.168.90.0/24
dst-address=192.168.90.198 out-interface=ether6_lan_90 dst-port=8443
log=no log-prefix=“”

and now the server replies are getting back to the app in the LAN correctly.

Many thanks

Steve

5

Currently I have the same exact problem, I have done that but does not work for me…

6

Post the output of /export hide-sensitive after replacing each occurrence of any public IP address you don’t want to show by a distinctive meaningful pattern such as my.public.ip.1, the internal IP address and port of the server, the LAN where the clients are placed, and the pattern you’ve used instead of the public IP you want the clients to access.