[yet another] simple port forwarding doesn't work?

RouterOS Beginner Basics
1

I know this has been asked a lot, because I see a bunch of threads… none of which ever seem to resolve the issue.

The wiki is pretty clear on how to do this:

/ip firewall nat add chain=dstnat dst-port=8082 action=dst-nat 
protocol=tcp to-address=192.168.1.103 to-port=8082

But it just doesn’t work! A tool such as http://www.canyouseeme.org/ shows the port is open… but I can’t connect.

I can access it (“it” being the web interface for the serice on port 8082 in this example) directly on the LAN (ie. http://192.168.1.103:8082) but not using the WAN IP. Pull this router out and go back to my cheap-o router and it works fine, so it isn’t a firewall configuration on the server. It has to be the router. But what? Oh, and I can also access the Mikrotik WebFig from the WAN IP (so I’m not screwing up on the IP).

I’m mostly using default setup. Here is /export:

# may/27/2016 22:55:26 by RouterOS 6.35.2
# software id = 48GP-CXP0
#
/interface bridge
add admin-mac=E4:8D:8C:22:42:40 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] name=01-WAN
set [ find default-name=ether2 ] name=02-OfficePC
set [ find default-name=ether3 ] master-port=02-OfficePC name=03-Server
set [ find default-name=ether4 ] master-port=02-OfficePC name=04-WAP
set [ find default-name=ether5 ] master-port=02-OfficePC name=05-Switch
set [ find default-name=ether6 ] name=06-VoIP-Master
set [ find default-name=ether7 ] master-port=06-VoIP-Master name=07-RainForest
set [ find default-name=ether8 ] master-port=06-VoIP-Master name=08-Sprinkler
set [ find default-name=ether9 ] name=09-Slow3
set [ find default-name=ether10 ] name=10-Slow4
/ip neighbor discovery
set "01-WAN" discover=no
set bridge comment=defconf
/ip pool
add name=dhcp ranges=192.168.1.10-192.168.1.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=02-OfficePC
add bridge=bridge comment=defconf interface=06-VoIP-Master
add bridge=bridge comment=defconf interface=sfp1
/ip address
add address=192.168.1.1/24 comment=defconf interface=02-OfficePC network=\
    192.168.1.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=01-WAN
/ip dhcp-server lease
add address=192.168.1.103 comment=Server mac-address=94:DE:80:E2:EF:C4 server=\
    defconf
/ip dhcp-server network
add address=192.168.1.0/24 comment=defconf gateway=192.168.1.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.1.1 name=router
/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept established,related" connection-state=\
    established,related
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=\
    01-WAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add chain=forward comment="defconf: accept established,related" \
    connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface=01-WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    01-WAN
add action=dst-nat chain=dstnat dst-port=8082 protocol=tcp to-addresses=\
    192.168.1.103 to-ports=8082
/system clock
set time-zone-name=America/Vancouver
/system routerboard settings
set protected-routerboot=disabled
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
2

Hello,

I’m not an expert but could you humour me and add dst-address=your_WAN_IP in the NAT rule.

I had a funny case where I had what you had, but it was giving me strange results. Putting in the dst-address worked for me at least.

3

by “your_WAN_IP” do you mean by public IP? If so, that didn’t help.





Shouldn’t this be REALLY easy? I mean… simple stuff like this should just work with the out of the box config.

4

Incidentally, When I click on “Statistics” for the NAT Rule, it shows zero activity when I attempt to connect, which seems to imply that whatever is preventing the connection is occuring upstream of this NAT Rule. I disabled all the Filter Rules (which were default) and that didn’t help either. When I use an open port checker, I do see activity on the Statistics tab. I’m perplexed how the port tool can see it but nothing else passes.

5

is the protocol definitely tcp?

6

painful as it may be, perhaps a reset of the configuration and start again.

7

Yes, definitely tcp. Works with my other router with just a simple tcp port forward. I double-checked to be sure I wasn’t forwarding “both” or just udp.

LOL @ restart… that’s all I’ve done since getting this Mikrotik. I’ve spent 2.5 long-hour days GETTING NOWHERE and have probably reset its config to default over 100 times.

I’m starting to wonder if either I have a defect or if there’s something wrong with the latest firmware and/or OS version? The first thing I did was update both. Seems crazy I can’t get a simple port forward to work. I posted my config and nobody’s said anything’s wrong with it.

8

Are trying to connect to your public address from same LAN where 192.168.1.103 is? If so, you need hairpin NAT.

9

Well, yes… yes I am. That sounds like it might get me somewhere, thanks.

10

Hang on… I can connect to the router’s WebFig interface using the public IP… so what’s the difference?

11

I gave it a try and it still doesn’t work, although perhaps I’m misunderstanding some of the elements. This is the config that page says to use:

/ip firewall nat
add chain=srcnat src-address=192.168.1.0/24 \
  dst-address=192.168.1.2 protocol=tcp dst-port=80 \
  out-interface=LAN action=masquerade

I’m sure I change 192.168.1.2 to 192.168.1.103 and dst-port=80 to dst-port=8082 (but thought i’d mention it in case I’m wrong)… I’m less clear on out-interface. I assumed it would be the interface that the server is on, but that failed saying I can’t select a slave and it suggested I select the master, which also complained because it is itself a slave of bridge so it suggested I choose that, which I did.

12

Maybe have a look at your Firewall filter.

As a newbie I am I would start to log firewall rules, and then see if it is the firewall filter.

We have a similar setup I have my webserver on 80, my firewall is - thanks to ZeroByte:

0    chain=input action=accept connection-state=established,related log=no log-prefix="" 

 1    ;;; Blocked Netflix adresser TV stue
      chain=forward action=drop src-address=192.168.1.201 dst-address-list=Blocked Netflix log=no log-prefix="" 

 2    ;;; Adgang til Router fra Interne IP
      chain=input action=accept src-address-list=Interne_IP log=no log-prefix="" 

 3    ;;; Disable ICMP 
      chain=input action=drop protocol=icmp in-interface=internet icmp-options=8:0-255 log=no log-prefix="" 

 4    ;;; Adgang til swich fra WAN
      chain=forward action=drop dst-address=192.168.1.254 in-interface=internet log=no log-prefix="" 

 5    chain=input action=drop log=no log-prefix=""

0 and 5 is basic securing, 2 and 4 is my own magic stuff.


Your filter:

add chain=input comment=“defconf: accept ICMP” protocol=icmp

add chain=input comment=“defconf: accept established,related” connection-state=
established,related

add action=drop chain=input comment=“defconf: drop all from WAN” in-interface=
01-WAN

add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related

add chain=forward comment=“defconf: accept established,related”
connection-state=established,related

add action=drop chain=forward comment=“defconf: drop invalid” connection-state=
invalid

add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface=01-WAN

The green shouldn’t that be the first rule - and have a action=accept.
The one in red shouldn’t that be the last rule.
An input chain would not interfere with forward chain
But I dont see any action=accept before drop.

Why do you have the ICMP rule, isnt that enable default

My NAT Table

 0    chain=srcnat action=masquerade out-interface=internet log=no log-prefix="" 

 1    chain=dstnat action=dst-nat to-addresses=192.168.1.42 to-ports=80 protocol=tcp dst-address=X.X.X.X dst-port=80 log=no log-prefix="" 

 2    chain=dstnat action=dst-nat to-addresses=192.168.1.10 to-ports=21 protocol=tcp dst-address=X.X.X.X dst-port=21 log=no log-prefix=""

Have you logged your DROP rules.

13

Thanks. As to your “shouldn’t” and “why” questions… beats me, ask MikroTik as that’s the default setup. I made the order changes you suggested (green first, red last) but it still doesn’t work.

I haven’t logged, no… I’m not really sure how to effectively do that. I tried “log” checkmark and gave it some prefix, and I found “log” in WinBox but that moves so fast I don’t see how it is helpful. I can “freeze” it, but I can’t search or even manage to copy it. It must be stored somewhere… I’ll keep looking.

[edit: i just now noticed you said “drop rules”… I was silly and turned on for all rules. looking again.]


I also want to mention that I tried downgrading (I randomly chose 6.14) in case this was some issue that crept up with latest… no help.

This is really quite frustrating.

14

OK, now logging just DROP rules… I see no drops from my connection attempt.

15

Sorry I edited my posting when you posted.

OK maybe its because you are missing the “action=accept”

If you dont have any use of the forward rules you made disable them.

Only have these 2 rules enable:

chain=input action=accept connection-state=established,related log=no log-prefix=“”
Should be the first and with action=accept


chain=input action=drop log=no log-prefix=“”
And the last

This will secure your router.

16

OK, so now I have just this:

[admin@MikroTik] > /ip firewall exp
# may/28/2016 12:36:54 by RouterOS 6.35.2
# software id = 48GP-CXP0
#
/ip firewall filter
add chain=input connection-state=established,related
add action=drop chain=input
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    01-WAN
add action=dst-nat chain=dstnat dst-port=8082 in-interface=01-WAN protocol=tcp \
    to-addresses=192.168.1.103 to-ports=8082

Note that it DOES say “accept” in the GUI, so I assume that accept must be the default and that’s why it isn’t explicit in the first filter above.

It didn’t work, but oddly it took a lot longer to think about it before failing. It also failed with a “took to long to respond” instead of the previous “rejected” (or something to that effect)

17

Your webserver is that on same subnet as the client your using, if so you have to check:

http://wiki.mikrotik.com/wiki/Hairpin_NAT

I have my webserver on a different subnet, and I have enabled the DNS in my RB just for the webserver, to keep traffic LAN traffic inside.

18

I already tried SOB’s hairpin suggestion… but we can easily prove if that’s the problem or not. Can you connect? I hesitate publishing my public IP but I don’t see a PM feature on here. Is there one?

19

I haven’t seen any PM funktion

But if you client is on the same subnet you need the hairpin.

Have you tried with your mobile phone, that was my approach until I got the correct filters.

20

I have no mobile to check with. Can you look above a few posts for my response to sob re: hairpin? I tried it and it didn’t help but I wasn’t 100% clear on what interface to specify.