SOLVED: September 5, 2023
https://forum.mikrotik.com/viewtopic.php?t=198838#p1023608 discovery
https://forum.mikrotik.com/viewtopic.php?t=179343 solution
This is probably not an issue if you actually, deeply understand how networking works. For the rest of us, here is the setup, the problem, and the solution:
If the below post applies to you, try using a different network, outside of your LAN, to reach the service you’re trying to port-forward. If you can reach the service using your external IP from a network other than your LAN – but you cannot see it using the same IP from within the same LAN as where the server is located, the solution is to apply a hairpin NAT.
The problem: internal traffic takes a different path than external traffic to reach any services you’re exposing through NAT or port-forwarding. As such, LAN traffic hitting the server looks different to the server than expected.
There are many solutions described in places such as https://help.mikrotik.com/docs/display/ROS/NAT#NAT-HairpinNAT and http://forum.mikrotik.com/t/hairpin-nat-the-easy-way/146718/1 – I followed a simpler set of steps as described in https://www.youtube.com/watch?v=_kw_bQyX-3U (as I don’t need dynamic WAN support).
Thanks to everybody that guided me here!
Original post below:
Hey there! Hope everybody’s doing well.
I’m new to the MikroTik ecosystem – I purchased my first device less than 8 or so months ago, and I’ve had no issues with it so far that I couldn’t find help for within a few Google searches. However, I am experiencing some issues recently with port forwarding that I haven’t encountered before.
A quick rundown of my network chain:
- Motorola/Arris SB8200
- MikroTik hEX S
- Netgear RAX54
LAG is enabled on the SB8200, and the MikroTik is paired with a bonded connection (ether1, ether2) to the modem. The RAX54 is in AP-only mode and is connected to the hEX S on ether4. The hEX S is running the latest LTS RouterOS v6.49.8.
In the past I configured the firewall NAT rules (on RouterOS) to publicly expose certain services from one of my LAN devices. The LAN device was connected via ether3 and a static IP to the hEX S. Recently, I’ve had to use a wireless connection for my device instead, which needed some massaging to fix the static IP briefly – but eventually the device fetched the right IP from the router using WiFi as well. However, I can’t seem to get port forwarding to work again. Previously, I had forwarded ports 3000 (some test server) and maybe 25565 (for Minecraft) – but right now, I’m trying to expose just 80 for an HTTP service.
I’m trying to expose 192.168.88.253:80 as <external_ip>:80, and here are the very basic filter and NAT rules that I’ve stripped down to while troubleshooting this issue:
[admin@RouterOS] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; fasttrack: established,related
chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix=""
2 ;;; accept: established,related
chain=input action=accept connection-state=established,related log=no log-prefix=""
3 ;;; accept: established,related
chain=forward action=accept connection-state=established,related log=no log-prefix=""
4 ;;; drop invalid
chain=input action=drop connection-state=invalid log=no log-prefix=""
5 ;;; drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix=""
6 ;;; Accept ICMP
chain=input action=accept protocol=icmp in-interface-list=WAN log=no log-prefix=""
[admin@RouterOS] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none
1 ;;; web server (80)
chain=dstnat action=dst-nat to-addresses=192.168.88.253 protocol=tcp dst-address=<external_ip> in-interface-list=WAN dst-port=80 log=yes log-prefix="web_server"
I get a filter log hit whenever I use this open port check tool to check port 80 on my external IP like so:
web_server dstnat: in:bonding1 out:(unknown 0), src-mac 00:01:5c:68:68:46, proto TCP (SYN), 198.199.98.246:41692-><external_ip>:80, len 60
but never when I use the browser, and by following some advice in another post here and running
/tool sniffer quick ip-address=<external_ip> port=80
I do see activity whenever I visit my external IP with my browser, so I don’t believe it is my ISP blocking port 80.
Any ideas, tips, or suggestions would be amazing. Thanks for an otherwise wonderful experience!
