Web Box Accessible, Web Server Not Accessible

RouterOS General
1

I have a web server behind mikrotik. Our remote offices connect to this web server. We recently installed mikrotik and this web server with a static IP is not accessible from outside. I can reach to our mikrotik webbox from internet but i cannot reach to the web server behind mikrotik.

We are using NAT with Web Proxy in Transparent mode.

Any help is appreciated.

2

Greetings!

You did not provide specifics, so I will make them up as I go.
Your public IP and internet is on ether1
Your localnet is on ether2, ip 192.168.0.1/24
Your web server is 192.168.0.2/24

Then this should do:
/ip firewall nat add dstnat action=dst-nat dst-address=xxx.xxx.xxx.xxx dst-port=80 to-addresses=192.168.0.2
Replace x’s with your public IP on ether1.

3

My setup is in reverse direction:) ether1 is local and ether2 is public interface. Can you please rewrite it?

Here are my rules

[admin@MikroTik] /ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Default Masquerading
chain=srcnat action=masquerade out-interface=ether2

1 ;;; Transparent Proxy
chain=dstnat action=redirect to-ports=8080 protocol=tcp
in-interface=ether1 src-port=80

2 ;;; HTTP Server
chain=dstnat action=dst-nat to-addresses=192.168.0.XX to-ports=80
protocol=tcp dst-address=XX.XX.XX.XX in-interface=ether1 dst-port=80

3 ;;; Source NATting
chain=srcnat action=src-nat to-addresses=XX.XX.XX.XX to-ports=80
protocol=tcp src-address=192.168.0.XX src-port=80

4 ;;; For Accessing Router from Local Network
chain=dstnat action=redirect to-ports=8080 protocol=tcp
dst-address=!192.168.0.1 in-interface=ether1 dst-port=80
[admin@MikroTik] /ip firewall nat>

4

This is the rule that is incorrect. It should have the in-interface=ether2. All else for the dstnat rule looks ok.

2 ;;; HTTP Server
chain=dstnat action=dst-nat to-addresses=192.168.0.XX to-ports=80
protocol=tcp dst-address=XX.XX.XX.XX in-interface=ether1 dst-port=80

Rule 3 will not be evaluated. Rule 0 (the default masquerade) will catch any srcnat before it gets to rule 3. It causes no problems. Just taking up space.

5

Thank you SurferTim

2 ;;; HTTP Server
chain=dstnat action=dst-nat to-addresses=192.168.0.XX to-ports=80
protocol=tcp dst-address=XX.XX.XX.XX in-interface=ether1 dst-port=80

It is working but by removing dst-address. May be my network is somewhat different from standard networks:)

Any ways thank you.