Solved: Problem: Forward port 443 to different servers

RouterOS General
1

Hello Mikrotik community,

following problem:

I have one external ip address. I want to forward port 443 to server01 or server02. Both are listening to ssh on port 443.

How can I access these servers from the outside ?

Normally I can only define one static NAT rule to forward e.g. to server01.

Is it possible, to define knock rules that will switch the NAT rule to forward to server02 ?

I hope you understand what I wanna do.

Regards

Carsten

2

maybe it’s better to forward external_ip:2001 to server01:443 and external_ip:2002 to server02:443?.. why do you need such complexity?..

3

Hi Chupaka,

I have two servers listening on ssh port 443. I have only one external ip address (it’s a privat line).

I must use port 443 for ssh because then I can go through firewalls and proxies (other ports are normally not allowed).

Sometimes I have to access server01 via putty and sometimes I have to access server02 via NXClient (NoMachine).

So I thought there’s a possibility to change the NAT rule “on the fly” via knock sequence or any other means.

Regards

Carsten

4

well, I’m not sure what knocking you can use if you have only 1 port allowed %)

5

Hi Chupaka,

I have solved the problem with a linux server behind the firewall.

There’s a knock daemon installed. When I knock with a special sequence it will connect to the Mikrotik router via ssh
and change the to-address of the NAT rule via script for the port 443.

But thanks anyway

Carsten

6

special sequence of what?..

7

Hi Chupaka,

with special sequence I mean a combination of sending udp port knocks to the knock daemon of my Linux system.

Regards

Carsten

8

that’s exactly what I was asking about: how do you use port knocking on udp, if all ports are blocked except 80/tcp and 443/tcp? :slight_smile:

if they are allowed, then you may use something like that:

/ip fi man add chain=prerouting in-interface=WAN dst-address-type=local protocol=tcp dst-port=12001 action=add-src-to-address-list address-list=to-server-1 address-list-timeout=00:00:05
/ip fi man add chain=prerouting in-interface=WAN dst-address-type=local protocol=tcp dst-port=12002 action=add-src-to-address-list address-list=to-server-2 address-list-timeout=00:00:05
/ip fi nat add chain=dstnat in-interface=WAN dst-address-type=local protocol=tcp dst-port=443 src-address-list=to-server-1 action=dst-nat to-addresses=server01_IP
/ip fi nat add chain=dstnat in-interface=WAN dst-address-type=local protocol=tcp dst-port=443 src-address-list=to-server-2 action=dst-nat to-addresses=server02_IP

now you just do ‘telnet IP 12001’ - and then you have 5 seconds to establish SSH connection to port 443 - and it will be redirected to server01. the same with server02 and ‘telnet IP 12002’

9

Hi Chupaka,

I didn’t say that I have blocked all ports. Of course I forward and nat the udp ports (the sequence) to the Linux server with the knock daemon.

Maybe I have misdescribed it.

I think, that’s exactly what I need. I’ll give it a try.

thanks

Carsten