Community discussions

MUM Europe 2020
 
talormanda
just joined
Topic Author
Posts: 3
Joined: Mon Jan 13, 2020 9:30 pm

Access internal web server with internet IP from the same LAN

Mon Jan 13, 2020 9:37 pm

Before switching to MT, I was able to port forward a web server, and access it via my public IP: http:mywebsite.com:40399

After I switched to MT, I went to IP > Firewall > NAT , and set up the below, which let's me access the web server from outside my network:

add action=dst-nat chain=dstnat comment=web-server dst-port=40399 protocol=tcp to-addresses=192.168.1.9
to-ports=80

I was looking around and saw that this may be called a "hairpin nat" ? I messed around with some rules and added this, which works, but I want to know if this is correct and the best way to achieve what I want to do:

add action=src-nat chain=srcnat comment="Hairpin NAT to for motioneye" dst-address=192.168.1.9 src-address=192.168.1.0/24 to-addresses=*my_public_ip_here*
 
User avatar
pukkita
Trainer
Trainer
Posts: 2997
Joined: Wed Dec 04, 2013 11:09 am
Location: Spain

Re: Access internal web server with internet IP from the same LAN

Mon Jan 13, 2020 9:43 pm

Yes. Have a look at https://wiki.mikrotik.com/wiki/Hairpin_NAT for the packet-by-packet explanation.

In summary, what happens is the internal device receives an answer from the internal, dst-natted IP when it expects the source IP it to come from the public IP it requested; hairpin nat does an additional src-nat so that device receives a answer with the src-address it expects (the one it requested).

You could also use action=masquerade if your WAN interface has only a public IP that is dynamically fetched from your ISP.
Simplicity is the Ultimate Sophistication - Da Vinci
Getting the most out of this forum
 
talormanda
just joined
Topic Author
Posts: 3
Joined: Mon Jan 13, 2020 9:30 pm

Re: Access internal web server with internet IP from the same LAN

Tue Jan 14, 2020 3:29 pm

Yes. Have a look at https://wiki.mikrotik.com/wiki/Hairpin_NAT for the packet-by-packet explanation.

In summary, what happens is the internal device receives an answer from the internal, dst-natted IP when it expects the source IP it to come from the public IP it requested; hairpin nat does an additional src-nat so that device receives a answer with the src-address it expects (the one it requested).

You could also use action=masquerade if your WAN interface has only a public IP that is dynamically fetched from your ISP.

Do you mean this?
add action=masquerade chain=srcnat comment="Hairpin NAT to for motioneye" dst-address=192.168.1.9 src-address=192.168.1.0/24 to-addresses=*my_public_ip_here*
 
User avatar
pukkita
Trainer
Trainer
Posts: 2997
Joined: Wed Dec 04, 2013 11:09 am
Location: Spain

Re: Access internal web server with internet IP from the same LAN

Tue Jan 14, 2020 5:47 pm

action=masquerade is the same as action=src-nat, but will automatically src-nat with the IP of the interface, so no to-addresses required.
add action=masquerade chain=srcnat comment="Hairpin NAT to for motioneye" dst-address=192.168.1.9 src-address=192.168.1.0/24 out-interface=YourLanBridge
Simplicity is the Ultimate Sophistication - Da Vinci
Getting the most out of this forum
 
talormanda
just joined
Topic Author
Posts: 3
Joined: Mon Jan 13, 2020 9:30 pm

Re: Access internal web server with internet IP from the same LAN

Tue Jan 14, 2020 5:53 pm

action=masquerade is the same as action=src-nat, but will automatically src-nat with the IP of the interface, so no to-addresses required.
add action=masquerade chain=srcnat comment="Hairpin NAT to for motioneye" dst-address=192.168.1.9 src-address=192.168.1.0/24 out-interface=YourLanBridge
Okay thanks, I will try this when I get home, unfortunately I am having packet loss, disconnect issues again (i made another post in this forum). So I cannot implement the change while I am remote.

Who is online

Users browsing this forum: anav, bgpro, Bing [Bot], Google [Bot] and 53 guests