Troublesome Firewall rule (NAT?)

RouterOS Beginner Basics
1

Hi all.

Was wondering if anyone would mind casting an eye over my firewall rule i have created for a specific scenario…

Scenario

I have 2 devices that live behind my router, both need to be accessible on specific ports, so we have:

10.0.0.155 running a webserver on 8082.

I’ve created two rules for this server, one firewall and one NAT, the firewall rule is seeing packets as I can see the counts increase when i try to access, but the NAT rule doesnt seem to be triggered, here is my NAT rule:

Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=dstnat action=dst-nat to-addresses=10.0.0.55 to-ports=8082 
      protocol=tcp src-port=8082 log=no log-prefix=""

And the firewall rule:

Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=input action=accept protocol=tcp dst-port=8082 log=no log-prefix=""

Any ideas ?

Thanks !!

2

In the NAT rule…
You didn’t define a dst-address.

In the Filter rule…
That is a forwarding rule in the /ip firewall filter
input terminates at the router.

3

Perhaps it’s a typo, in text you have 10.0.0.155, in NAT rule IP is 10.0.0.55
Remove from NAT rule src-port=8082 and add in-interface=your-wan-interface (or dst-address=your-wan-ip) to it. And, you don’t need this firewall rule, except, if you are blocking all tcp ports in forward chain (unlikely). You can and should drop all connections from wan with connection-nat-state=!dstnat instead.

4

Thank you, working like a charm now :slight_smile:

Nik

5

One more question !!

If i have the 2 devices … cctv1.host.net and cctv2.host.net and they listen on different ports … is it possible to create a single firewall rule that says in the traffic is due for host 1 go to port x and if for host 2 got to port y ?

e:g.

user connects to:

http://cctv1.host.net

but that gets translated to internal ip and port of:

http://10.0.0.155:8082

or

http://cctv2.host.net

but that gets translated to internal ip and port of:

http://10.0.0.151:8084


Thanks

Nik

6

Probably you could do that using L7 filtering capabilities. However it’s (router’s) CPU intensive. If you can, better use two different ports, forwarded to rwo different LAN IP addresses. Or install a tiny device (Rasberry PI would do) with http proxy installed.

7

Thanks !

Will skip that idea then :slight_smile: