Working dst-nat blocks internal request to remote server same port

RouterOS Beginner Basics
1

Hello,
I’ve connected a rb951g with os 6.33.3 to my vdsl2 router with pppoe on ether1 and a linux box with wifi card is associated to mikrotik ssid and navigation works.
I’ve added then a port forward from pppoe-out1 interface (the wan interface with public ip) to port 1194 tcp and udp to my linux box (ip 192.168.1.251) which runs openvpn server:

[admin@MikroTik-vdsl] /ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
 0    ;;; default configuration
      chain=srcnat action=masquerade to-addresses=0.0.0.0 out-interface=pppoe-out1 log=no log-prefix=""

 1    chain=dstnat action=dst-nat to-addresses=192.168.1.251 to-ports=1194 protocol=udp dst-port=1194 log=no log-prefix=""

 2    chain=dstnat action=dst-nat to-addresses=192.168.1.251 to-ports=1194 protocol=tcp dst-port=1194 log=no log-prefix=""

 3    chain=srcnat action=masquerade protocol=tcp src-address=192.168.1.0/24 dst-address=192.168.1.251 out-interface=bridge-local dst-port=1194 log=no log-prefix=""

 4    chain=srcnat action=masquerade protocol=udp src-address=192.168.1.0/24 dst-address=192.168.1.251 out-interface=bridge-local dst-port=1194 log=no log-prefix=""

Openvpn connections from internet works without problems.

The problem here is this: I must connect from another pc on the lan (192.168.1.x) to external openvpn server using an openvpn client, but my connections are redirected to my internal openvpn server (192.168.1.251), failing to connect to the right server.

What I’m missing?

2

Your dstnat rule is too aggressive - it maches all traffic with the destination port, regardless of destination host, etc.

You could add the criteria in-interface=wan to each of your dstnat rules, which will fix your problem, unless you’re also trying to use the external IP of your network from inside the LAN (hairpin nat)

If you’re using hairpin NAT, then don’t use in-interface=WAN - use dst-address-type=local dst-address=!192.168.0.0/16
(in the GUI, dst-address-type is in the ‘Extra’ tab of the rule)

3

that fixed my problem, adding in-interface=pppoe-out1

I will keep this in mind if I need to access to the subnet behind my local openvpn server using an openvpn connection.

Thanks!

Manuel