Hi there, I am trying to host a Factorio server on my server PC and when attempting to port forward, nothing is working.
I have tried seeing if I can “copy” some of the other fourm fixes, however, I am still somewhat new to Mikrotik and am having no luck. I know that with my older router, it would work fine so I doubt my ISP is blocking anything, and all my TCP forwards work, however, it’s just my factorio server that seems to struggle on UDP.
/ip firewall nat
add action=dst-nat chain=dstnat comment="Forward Factorio Traffic - BROKEN" \
dst-port=34197 in-interface-list=WANInterfaces log=yes log-prefix=\
"Factorio-NAT: " protocol=udp to-addresses=192.168.10.5 to-ports=34197
There is nothing in logs, and all works fine locally, it’s only when trying to come in over WAN or my public IP, it stops working.
Here is my full firewall config as it stands. (Minus the address lists)
/ip firewall connection tracking
set udp-timeout=10s
/ip firewall filter
add action=fasttrack-connection chain=input comment=\
"Fast track RDP connections" disabled=yes dst-port=3389 hw-offload=yes \
in-interface-list=WANInterfaces protocol=tcp src-address-list=RDPAccess
add action=fasttrack-connection chain=output disabled=yes dst-address-list=\
RDPAccess dst-port=3389 hw-offload=yes out-interface-list=WANInterfaces \
protocol=tcp
add action=fasttrack-connection chain=input comment=\
"Fast track main PC connections" dst-address=192.168.10.10 hw-offload=yes \
in-interface-list=WANInterfaces protocol=tcp
add action=fasttrack-connection chain=output hw-offload=yes out-interface-list=\
WANInterfaces protocol=tcp src-address=192.168.10.10
add action=add-src-to-address-list address-list=spammers address-list-timeout=\
3h chain=forward comment="Add Mail Spammers to the list for 3 hours" \
connection-limit=30,32 disabled=yes dst-port=25,587 limit=30/1m,0:packet \
log=yes protocol=tcp
add action=tarpit chain=forward comment="Avoid Mail spammers action-TARPIT" \
disabled=yes dst-port=25,587 log=yes log-prefix="USER TARPITTED" protocol=\
tcp src-address-list=spammers
add action=accept chain=input comment="Allow internet to the router" \
connection-state=established,related
add action=accept chain=forward comment="Allow internet to devices" \
connection-state=established,related
add action=drop chain=forward comment="Drop invalid packets" connection-state=\
invalid
add chain=input comment="Allow Limited ICMP" limit=5,10:packet protocol=icmp
add action=drop chain=input comment="Drop Excessive ICMP" protocol=icmp
add action=add-src-to-address-list address-list=PortScanners \
address-list-timeout=none-static chain=input comment="Detect Port Scanners" \
log=yes log-prefix="[Port Scanners] " protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop Port Scanners" src-address-list=\
PortScanners
add action=add-src-to-address-list address-list=DDOS_Attackers \
address-list-timeout=none-static chain=forward comment="Detect DDOS" \
connection-limit=100,32 log=yes log-prefix="[DDOS] " src-address-list=\
!Local
add action=drop chain=forward comment="Drop DDOS Attacks" src-address-list=\
DDOS_Attackers
add action=drop chain=forward comment="Drop all not NAT" connection-nat-state=\
!dstnat connection-state=new disabled=yes in-interface-list=WANInterfaces
add action=drop chain=input comment="Drop all traffic to WAN interfaces" \
in-interface-list=WANInterfaces
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade for WAN Traffic" \
out-interface-list=WANInterfaces
add action=dst-nat chain=dstnat comment="Forward RDP Traffic" dst-port=3389 \
in-interface-list=WANInterfaces protocol=tcp src-address-list=RDPAccess \
to-addresses=192.168.10.10 to-ports=3389
add action=dst-nat chain=dstnat comment="Forward Winbox Traffic" dst-port=8291 \
in-interface-list=WANInterfaces log=yes log-prefix=Winbox protocol=tcp \
src-address-list=Tech5 to-addresses=192.168.10.1 to-ports=8291
add action=dst-nat chain=dstnat comment="Forward Minecraft Server Traffic" \
dst-port=25565 in-interface-list=WANInterfaces protocol=tcp to-addresses=\
192.168.10.5 to-ports=25565
add action=dst-nat chain=dstnat comment=\
"Forward Minecraft Voice Chat Traffic - Possibly broken" dst-port=24454 \
log=yes log-prefix=test protocol=udp to-addresses=192.168.10.5 to-ports=\
24454
add action=dst-nat chain=dstnat comment="Forward Factorio Traffic - BROKEN" \
dst-port=34197 in-interface-list=WANInterfaces log=yes log-prefix=\
"Factorio-NAT: " protocol=udp to-addresses=192.168.10.5 to-ports=34197
add action=dst-nat chain=dstnat comment="Forward HTTP Traffic" dst-port=80 \
in-interface-list=WANInterfaces protocol=tcp to-addresses=192.168.10.5 \
to-ports=80
add action=dst-nat chain=dstnat comment="Forward HTTPS Traffic" dst-port=443 \
in-interface-list=WANInterfaces protocol=tcp to-addresses=192.168.10.5 \
to-ports=443
add action=dst-nat chain=dstnat comment="Forward Server SSH Traffic" dst-port=\
22 in-interface-list=WANInterfaces protocol=tcp src-address-list=SSHAccess \
to-addresses=192.168.10.5 to-ports=22
add action=dst-nat chain=dstnat comment="Forward VM Winbox port" dst-port=8291 \
in-interface-list=WANInterfaces protocol=tcp src-address-list=SSHAccess \
to-addresses=192.168.10.15 to-ports=8291
add action=dst-nat chain=dstnat comment="Forward VM Winbox port" dst-port=8292 \
in-interface-list=WANInterfaces protocol=tcp src-address-list=SSHAccess \
to-addresses=192.168.10.16 to-ports=8291
I thought that maybe, if I can’t get the port forward right, I’d use UPnP, however, that is not detected either. I enabled it, added my Bridge as internal and my PPPoE client as external, still nothing, so I am just unsure as of how to go about this now.
If anything more is needed, please let me know and I apologize if this is a super newbie question, I have still got a lot to learn in the world of Mikrotik and networking as a whole. Any and all help is greatly appreciated.