I tried enableing a simple port forward this morning (on a 750G)…but I can’t get it to work.
I tried it with ftp forwarding a few weeks back and it worked great. Now I tried forwarding a remote desktop (port 3389) and it just won’t do what I want it to.
Move these above the the “chain=input action=drop” rule. You can add additional parameters, like src-address if you want to limit it to specific ips/networks.
Sorry, but that won’t work. Destination NAT happens after pre-routing, then after dest NAT the router looks at the destination IP and puts the packet into input if the IP is on a route interface, and into forward if it is not.
According to the details posted this should work. So the information posted is either edited (stuff that makes it not work is missing from those sections, such as firewall filters in prerouting, forward, or postrouting), the rule is too specific (drop the dst-address qualifier from the NAT rule if you have a dynamic IP and it had changed since), or a firewall is dropping things outside of the router (on the RDP host, or on the way to the router somewhere in an ISP).
Just for completeness post the output of “/ip address print detail”, “/ip route print detail”, “/interface print”, “/ip firewall export”, and an accurate network diagram. Maybe the segment that makes it not work on the router will stand out.
yes, I did shorten the output a little bit and changed some IP addresses, because the LAN IP is confusing.
Here is the complete output, never mind the LAN addresses, they are fine like that. It wasn’t my idea though
/ip route> print detail
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, B - blackhole, U - unreachable, P - prohibit
0 X S dst-address=0.0.0.0/0 gateway=ether1-WAN1-Kabel100 gateway-status=ether1-WAN1-Kabel100 inactive distance=1 scope=30 target-scope=10 routing-mark=viaWAN1
1 X S dst-address=0.0.0.0/0 gateway=ether2-WAN2-Kabel32 gateway-status=ether2-WAN2-Kabel32 inactive distance=1 scope=30 target-scope=10 routing-mark=viaWAN2
2 ADS dst-address=0.0.0.0/0 gateway=95.208.108.1 gateway-status=95.208.108.1 reachable ether1-WAN1-Kabel100 distance=1 scope=30 target-scope=10
3 ADC dst-address=95.208.108.0/22 pref-src=95.208.108.132 gateway=ether1-WAN1-Kabel100 gateway-status=ether1-WAN1-Kabel100 reachable distance=0 scope=10
4 ADC dst-address=181.123.1.0/24 pref-src=181.123.1.2 gateway=ether3-LAN1-master gateway-status=ether3-LAN1-master reachable distance=0 scope=10
That should work. Does the host you’re trying to RDP into have general access TO the Internet, i.e. is network access outbound working fine? If yes, I’m going to bet that something other than the router is blocking traffic - either another router/firewall, or the host firewall.
I just talked to the admin of 181.123.1.30:
He actually routes his traffic through 181.123.1.1 to get to the internet. So it works fine, but through another router.
Is that the cause of the problem?
Yes. If it goes through another router then the Mikrotik router never sees the return traffic, so it can’t forward the return traffic to whatever client is establishing the RDP session.
You can work around that by source NATing that traffic to the router LAN interface, which will make the RDP server think that the traffic was initiated locally, so it won’t use its default route for return traffic. A side effect is that the logs on that server will always show 181.123.1.2 as the source of any RDP connections.
THIS MAY VIOLATE THE SECURITY POLICY OF THE NETWORK. CHECK WITH THE APPROPRIATE ADMINS BEFORE IMPLEMENTING THIS.
