Short description of the problem:
on my 951G-2HnD, when an incoming connection requests TCP port 55000, it should be redirected to local address 192.168.88.254 and the port 3389 (which is windows machine, available by RDP). To this end, I added a rule:
Code: Select all
/ip firewall nat add chain=dstnat action=dst-nat to-addresses=192.168.88.254 to-ports=3389 protocol=tcp in-interface=ether1 dst-port=55000Then I connect to 111.111.111.222:55000 using RDP, but connection is not established!
Please look at the details of my configuration:
ISP dynamic ip: 111.111.111.222 (this is the address assigned to me by the ISP for remote access. So I can ssh to my router. This IP does not change).
ISP network: 111.111.111.0
My local network: 192.168.88.0/24
Interface for ISP: ether1
Interfaces for local network: ether2,3,4,5 with bridge
Code: Select all
[username@hostname] > /ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; defconf
192.168.88.1/24 192.168.88.0 bridge
1 D 111.111.111.222/24 111.111.111.0 ether1
Code: Select all
[username@hostname] > /ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=input action=drop src-address-list=bogon in-interface=ether1
1 chain=input action=accept connection-state=established,related,untracked
2 chain=input action=drop connection-state=invalid
3 chain=input action=accept protocol=icmp
4 chain=forward action=accept connection-state=established,related,untracked
5 chain=forward action=drop connection-state=invalid
6 chain=input action=drop connection-state=new in-interface=!bridge
7 chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether1
Code: Select all
[username@hostname] > /ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=ether1
1 chain=dstnat action=dst-nat to-addresses=192.168.88.254 to-ports=3389 protocol=tcp
in-interface=ether1 dst-port=55000
Code: Select all
[username@hostname] > /ip route print
Flags: X - disabled, A - active, D - dynamic,
C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 111.111.111.1 1
1 ADC 111.111.111.0/24 111.111.111.222 ether1 0
2 ADC 192.168.88.0/24 192.168.88.1 bridge 0
What should I add to my configuration?
Thanks!
