Thanks.
Hi everyone,
Regarding the main topic - I’m setting up an Nginx server that should be accessible via WAN1 (public IP), and I want it to have a LAN IP in the same subnet as other LAN devices: 192.168.88.20.
Other LAN devices use a routing table that sends traffic through WAN2.
My goal is for all traffic from this device (.20 Nginx ) to use the main routing table (routing via WAN1 ). The internal WireGuard server will also use the main table, while the rest of the LAN should follow prefer-WAN2.
Here are my current routing rules:
/routing rule print Flags: X - DISABLED, I - INACTIVE; * - DEFAULT
0 ;;; all-not-managed-to-main action=lookup table=main min-prefix=0
1 ;;; Headscale + Nginx src-address=192.168.88.20/32 action=lookup table=main
2 ;;; LAN-to-ether2 src-address=192.168.88.0/24 action=lookup table=prefer-WAN2
3 ;;; WireGuard-to-internet interface=wg1 action=lookup table=prefer-WAN2
Nginx diagnostic issue
From the server itself (.20), these commands work correctly:
curl -k https://192.168.88.20/health
{"status":"pass"}
curl -k https://localhost/health
{"status":"pass"}
But these do not work locally from Nginx server or LAN devices :
curl -k https://<Public IP>/health
curl -k https://<Public domain>/health
# Error:
# curl: (7) Failed to connect to <Public IP> port 443 after 0 ms: Couldn't connect to server
Interestingly, these same commands work fine from the internet.
I have configured hairpin NAT:
0 ;;; Hairpin NAT
chain=srcnat action=masquerade src-address=192.168.88.0/24 dst-address=<Public IP> log=no log-prefix=""
Whole NAT :
/ip firewall nat print
Flags: X - DISABLED, I - INVALID; D - DYNAMIC
0 ;;; Hairpin NAT
chain=srcnat action=masquerade src-address=192.168.88.0/24 dst-address= log=no log-prefix=""
1 ;;; Nginx 443
chain=dstnat action=dst-nat to-addresses=192.168.88.20 to-ports=443 protocol=tcp in-interface=ether1 dst-port=443 log=no log-prefix=""
2 ;;; Nginx 80
chain=dstnat action=dst-nat to-addresses=192.168.88.20 to-ports=80 protocol=tcp in-interface=ether1 dst-port=80 log=no log-prefix=""
3 ;;; Nginx 3478
chain=dstnat action=dst-nat to-addresses=192.168.88.20 to-ports=3478 protocol=udp in-interface=ether1 dst-port=3478 log=no log-prefix=""
4 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface=ether2 log=no log-prefix="" ipsec-policy=out,none
5 ;;; pihole
chain=srcnat action=masquerade src-address=172.17.0.0/24 log=no log-prefix=""
…but it does not solve the issue.
When I enter my public IP in a browser from a computer on the local LAN, the MikroTik router's web page opens instead of being redirected to the Nginx server. However, accessing the same IP from the Internet works correctly and reaches Nginx.
Disabling WWW services on router does not solve the issue.**
Question:**
-
Is my routing rule setup correct for this scenario?
-
Why can’t I reach Nginx from LAN via public IP / domain, even with hairpin NAT?
-
Could this dual WAN / routing table setup cause unexpected issues with NAT or traffic flow?
Thanks in advance for any advice!
Tim
