Community discussions

MikroTik App
 
User avatar
homerwsmith
Member Candidate
Member Candidate
Topic Author
Posts: 166
Joined: Fri Dec 02, 2011 3:01 am
Location: Ithaca, NY
Contact:

Double port forwarding

Thu Nov 15, 2018 5:23 am

I am a newbie, but I understand the basics.

Customer has Verizon DSL modem -> Netgear Router with RDC port forwarding from 3391 to 3389 on Windows server.

DSL modem is at 129..x..x..x and hands out DHCP subnet to Netgear Router, 192.168.1.0/30

Thus the Netgear is at 192.168.1.2.

The Netgear in turn hands out DHCP on 10.0.0.0/24 to a windows server at 10.0.0.75:3389

If one RDC's from a remote windows box to 129.x.x.x:3189 the reqest is passed to the windows server at 10.0.0.75:3389

I wish to replace the netgear with a MT 951 so I can set up vpn.

The MT had its config cleaned, as I am used to setting up configs by hand.

The MT WAN IP is received from DSL modem as 192.168.1.2/30

The MT LAN IP is manually set to 10.0.0.1/24 with windows internal server at 10.0.0.75/25

Ether 1 is the WAN, and Bridge 1 is the LAN on ether 2 3 4 5.

There are two firewall rules entered by hand.

1.) The first sets ups src-nat using masquerade between the WAN outgoing port eth1 and IP 192.168.1.2.

I trust the DSL modem nats it again to 129.x.x.x.

2.)I also I trust the DSL modem sets ups incoming DST-NAT from 129.x.x.x:3189 on modem to 192.168.1.2:3191 on MT WAN because the netgear shows port forwarding as RDC 3391 3391 3389 3389 10.0.0.75.

A second firewall rule in MT setups up a DST-NAT from 192.168.1.2:3191 to 10.0.0.75:3189

The netgear setup has been working fine to allow remote RDC connections to the server at 10.0.0.75.

My MT settings will not allow the connection to work, although standard internet access works fine across the masquerade.

I there something dead obvious about what I have done?

I have no access to the DSL modem, and I have local access to the MT but I have to go to the office to talk to it.

I simply want to be able to RDC to the 129.x.x.x., have it go to the server at 10.0.0.75, and then allow me to CHROME back
to the MT at 10.0.0.1 with webfig.

Homer Smith, CEO LIghtlink Internet.
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Double port forwarding  [SOLVED]

Thu Nov 15, 2018 3:02 pm

Very complicated explanation.
If you required port forwarding and your modem is acting like a router, then your stuck as the modem would need to start the port forwarding chain.

Sounds more like you want static routes??
 
User avatar
homerwsmith
Member Candidate
Member Candidate
Topic Author
Posts: 166
Joined: Fri Dec 02, 2011 3:01 am
Location: Ithaca, NY
Contact:

Re: Double port forwarding

Thu Nov 15, 2018 8:48 pm

thank you for responding and trying to understand my complicated post.

The DSL modem is a router, and is already doing the first player of port forwarding to the WLAN of the MT port 3389 I believe.

Homer
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 18958
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Double port forwarding

Thu Nov 15, 2018 9:41 pm

Hi homer, unless you have direct control of the modem/router (at the control of the ISP), it is more than likely that there is no port forward assigned.
If you are saying that the modem.router is being controlled by a third party (landlord etc) then they should be able to show you that a port fowarding rule has been created (IM assuming at your request) and thus we can confirm if that is the case.
 
Sean222
just joined
Posts: 1
Joined: Wed Oct 17, 2018 2:31 pm

Re: Double port forwarding

Fri Nov 16, 2018 9:57 am

Important Things to Notice:
Both "Router #1" and "Router #2" have TWO IP addresses; an Internal IP address and an External IP address.

There are TWO LANs (Local Area Networks).

There are TWO WANs (Wide Area Networks). If there is a LAN then there is an accompanying WAN.
 
User avatar
Steveocee
Forum Guru
Forum Guru
Posts: 1120
Joined: Tue Jul 21, 2015 10:09 pm
Location: UK
Contact:

Re: Double port forwarding

Fri Nov 16, 2018 11:04 am

I think you want something like this, you won't be able to copy/paste it as my in-interface name is probably different to yours, change this for your WAN interface name and it should work.;
/ip firewall nat
add action=dst-nat chain=dstnat comment=example-rule dst-port=3189 in-interface=ether1_WAN protocol=tcp to-addresses=10.0.0.75 to-ports=3189

Who is online

Users browsing this forum: GoogleOther [Bot] and 60 guests