@anav i do not understand that not “!” on your dst-nat rule…
In case as you state there is a dynamic WAN IP and lets say i use the cloud dns of the Mikrotik Device that points to 10.0.10.1 when resolved within the LAN, then your dst-nat rule without the “!” would work just fine…
Hi Zach, I blame everything I know on Sob and Mkx, but i will give it a go…
Since we do not know what the WANIP is, we use the dst-address type-local local.
This tells the router, the packet is going to an interface on the router, could be LAN, could be WAN
But when we define the dst-address we say, destination is anywhere EXCEPT the local LAN.
That leaves only the WAN left…
So the destination is the WAN interface and thus the WANIP.
Or something like that.
Where it falls apart for me, is what happens when there are three LAN subnets 192.168.0.1, 192.168.1.1, and 192.168.2.1 (and the server is 192.168.0.10).
In this case I am lost as the router has two other interfaces to consider.
What If Had the subnet and 5 vlans, what would the router do??
@anv everything is understood…
However, could you give me an actual example so that i understand the logic behind that ?
You say there is a Public WAN IP, so what do i hit inside my LAN so that i access my device? Do i use a DNS service ? If yes, is that resolved to my routers Local IP or the Public one ? If no DNS is used what address will i make use of ?
I do approach a little differently cases like this thats why i ask.. so that i test your case in real…
This is straight forward case when you have users that need to access the server via its WANIP address and not directly through the LANIP of the server.
If you mean how do the users access the server, I would say the same way I would set it up for external users, DYNDNS name for example (yes resolves to Wan IP).
Thats what I do for mine as I have my septic panel available to servicing folks locally and in the US, so I have them on a source address list and I give them a dyndns that I setup so they dont have to get the current wan IP number from me.
I have a dynamic WAN IP and use Dynamic DNS. Clients get the WAN IP address via DNS.
Tried all of these, none of them seems to work for hairpin NAT:
;;; Seems closest to example in https://wiki.mikrotik.com/wiki/Hairpin_NAT
chain=srcnat action=masquerade protocol=tcp
src-address=10.0.10.0/24 dst-address=10.0.10.3
out-interface=BLUE_VLAN dst-port=8023
;;; no out-interface
chain=srcnat action=masquerade protocol=tcp
src-address=10.0.10.0/24 dst-address=10.0.10.3 dst-port=8023
;;; dst-address is whole subnet
chain=srcnat action=masquerade protocol=tcp
src-address=10.0.10.0/24 dst-address=10.0.10.0/24 dst-port=8023
;;; no dst-port
chain=srcnat action=masquerade protocol=tcp
src-address=10.0.10.0/24 dst-address=10.0.10.0/24
;;; no protocol
chain=srcnat action=masquerade src-address=10.0.10.0/24
dst-address=10.0.10.0/24
Updated this with my current config:
https://gist.github.com/garymm/50f155000139f61cae4ba2a0abc665ef
(hairpin NAT rule is disabled there b/c it wasn’t working)
Additionally DNS seems to be flaky on my VLAN 10 WiFi clients (haven’t checked wired yet). Any ideas what’s going on with that?
Thanks again for all the help y’all.
In your case @xian1sheng1 all three rules would work just fine for you… I start to think that you might have something else missing and thats why you cant access your device… wrong ports ? wrong IP? Who knows.. only you 
@anav i tested your case, which as you remember i had a little disaggreement, with all the respect ofcorse , about the dst-address=10.0.10.1…
My conclusion is that i found none cases where is should in particular !10.0.10.1 …which was and my question since the beginning… why in particular the Router’s address…
We can just use dst-address-type invert local… or just !10.0.10.0/24… So maybe i miss a specific case why the routers address must be exluded… ?
Looked at your config and all looks good to me.
Not sure if it makes a difference but put this rule before the dst nat rules in case it makes a difference…
chain=srcnat action=masquerade src-address=10.0.10.0/24
dst-address=10.0.10.0/24
Why does everyone keep making the same mistake? Hairpin NAT means that connections will be coming from LAN. Guess what will happen when dstnat rule has in-interface-list=WAN. Right, nothing.
Please take your meds, no one here is saying anything different.
Not every destination nat rule in a config needs hairpin if the OP doesnt want it…
So a config can have a combination of both regular dst NAT rules WITH in-interface-list=WAN, and the ones requiring hairpin nat will NOT.
What is also true is that if there is at least one hairpin dst nat rule, then one will have to have at least two src nat rules.
OP’s last post suggests that it’s wanted. And linked config has all dstnat rules in-interface-list=WAN. So I thought it wouldn’t hurt to mention in.