Hello everyone,
We try to foward our internal Exchange Server to reach our 10.0.0.0 Backbone Net. The Monitoring Server is bound in this network.
It can ping the MT Router with the BB IP, but the forwarding to the Server doesn´t work.
Here is the output from our Firewall Rules.
/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface=ether2
src-address=192.168.20.0/24
add action=dst-nat chain=dstnat comment=WTS disabled=no dst-address=
10.255.255.163 dst-port=3389 in-interface=ether2 protocol=tcp
to-addresses=192.168.20.10 to-ports=3389
add action=dst-nat chain=dstnat disabled=no dst-address=10.1.3.1 dst-port=
3389 in-interface=ether2 protocol=tcp to-addresses=192.168.20.10
to-ports=3389
add action=dst-nat chain=dstnat comment=Exchange disabled=no dst-address=
10.255.255.163 dst-port=25 in-interface=ether2 protocol=tcp to-addresses=
192.168.20.7 to-ports=25
add action=dst-nat chain=dstnat disabled=no dst-address=10.1.3.1 dst-port=25
in-interface=ether2 protocol=tcp to-addresses=192.168.20.7 to-ports=25
add action=dst-nat chain=dstnat disabled=no dst-address=10.255.255.163
dst-port=80 in-interface=ether2 protocol=tcp to-addresses=192.168.20.7
to-ports=80
add action=dst-nat chain=dstnat disabled=no dst-address=10.1.3.1 dst-port=80
in-interface=ether2 protocol=tcp to-addresses=192.168.20.7 to-ports=80
add action=dst-nat chain=dstnat disabled=no dst-address=10.255.255.163
dst-port=443 in-interface=ether2 protocol=tcp to-addresses=192.168.20.7
to-ports=443
add action=dst-nat chain=dstnat disabled=no dst-address=10.1.3.1 dst-port=443
in-interface=ether2 protocol=tcp to-addresses=192.168.20.7 to-ports=443
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s
tcp-close-wait-timeout=10s tcp-established-timeout=1d
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=yes
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=drop chain=input comment=“drop invalid” connection-state=invalid
disabled=no protocol=tcp
add action=drop chain=forward comment=“drop invalid” connection-state=invalid
disabled=no protocol=tcp
add action=accept chain=input comment=est/rel connection-state=established
disabled=no protocol=tcp
add action=accept chain=forward comment=est/rel connection-state=established
disabled=no protocol=tcp
add action=accept chain=input connection-state=related disabled=no protocol=
tcp
add action=accept chain=forward connection-state=related disabled=no
protocol=tcp
add action=accept chain=input connection-state=established disabled=no
protocol=udp
add action=accept chain=forward disabled=no protocol=udp
add action=accept chain=input comment=ICMP disabled=no protocol=icmp
add action=accept chain=forward comment=ICMP disabled=no protocol=icmp
add action=accept chain=input disabled=no protocol=igmp
add action=accept chain=input comment=OSPF disabled=no in-interface=ether2
protocol=ospf
add action=accept chain=input comment=OSPF disabled=no in-interface=ether4
protocol=ospf
add action=accept chain=input comment=BGP disabled=no dst-port=179 protocol=
tcp
add action=accept chain=input comment=DHCP disabled=no dst-port=67 protocol=
tcp
add action=accept chain=input disabled=no dst-port=67 protocol=udp
add action=accept chain=input comment=MPLS disabled=no dst-port=646 protocol=
tcp
add action=accept chain=input disabled=no dst-port=646 protocol=udp
add action=accept chain=input comment=MGNT disabled=no dst-port=
20-23,161-162,8291 protocol=tcp
add action=accept chain=input disabled=no dst-port=161-162,5678 protocol=udp
add action=accept chain=input comment=MCD disabled=no in-interface=ether1
add action=accept chain=forward comment=MCD disabled=no in-interface=ether1
add action=accept chain=forward comment=DDLAN disabled=no dst-address=
10.0.0.0/8 src-address=10.0.0.0/8
add action=accept chain=forward comment=WTS disabled=no dst-address=
192.168.20.10 dst-port=3389 protocol=tcp src-address=10.0.0.0/8
add action=accept chain=forward comment=Exchange disabled=no dst-address=
192.168.20.7 dst-port=25,80,443 protocol=tcp src-address=10.0.0.0/8
add action=drop chain=forward comment=“drop all” disabled=no
add action=drop chain=input comment=“drop all” disabled=no
Can someony Help me, i tried some Solution from here, but cant solve my Problem