Community discussions

MikroTik App
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

I can't port forward my hexS MikroTik router. Help

Mon Mar 23, 2020 2:51 pm

So I have been working on a server, which is working fine when doing tests over LAN. When I tried to port forward my server, I failed. I tried following a lot of tutorials on the internet, but nothing helps. Is it because I am using this site? https://www.yougetsignal.com/tools/open-ports/ It says my port is not forwarded.
Here is what I did so far:
s.png
b.png
I swear I followed every tutorial on the internet, it didn't help.

I am new to this router, please help. Thanks in advance
You do not have the required permissions to view the files attached to this post.
 
anav
Forum Guru
Forum Guru
Posts: 3605
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: I can't port forward my hexS MikroTik router. Help

Mon Mar 23, 2020 5:58 pm

Lots of garbage tutorials on the net.
Best bet is to post you config to have a look at. Manyconfig items are interelated so hunt and peck wastes everybodys time.

/export hide-sensitive file=anyname.

In winbox go to the windows terminal menu choice and type the above
In winbox go to the files menu choice find the file and right click download to PC
On pc use notepadd++ to open the file copy and paste it in here.
Use the code brackets (above black square with white square brackets)
Before submitting ensure you remove your actual wanip with x.x.x.x.x
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 11:41 am

Here is my setup:
(Sorry if I did something wrong)
# mar/24/2020 12:32:42 by RouterOS 6.46.2
# software id = 43JG-2Y1F
#
# model = RB760iGS
# serial number = A36A0AC106FF
/interface bridge
add admin-mac=74:4D:28:AF:9F:1E auto-mac=no comment=defconf name=bridgeLocal
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.3-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridgeLocal name=dhcp1
/interface bridge port
add bridge=bridgeLocal comment=defconf disabled=yes interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
add bridge=bridgeLocal comment=defconf interface=ether3
add bridge=bridgeLocal comment=defconf interface=ether4
add bridge=bridgeLocal comment=defconf interface=ether5
add bridge=bridgeLocal comment=defconf interface=sfp1
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=sfp1 list=LAN
add interface=bridgeLocal list=LAN
/ip address
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.1 netmask=24
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=x.x.x.x dst-port=54000 \
    protocol=tcp to-addresses=192.168.88.254
add action=masquerade chain=srcnat out-interface-list=WAN
Thanks for trying to help me, I appreciate it a lot :)
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 12:10 pm

/ip address
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
Assign the Address on your Bridge interface and not in the Slave ether 2 Interface...

Also your Mikrotik Router is Behind NAT... Your Public IP Address is at your ISP's Router...
You have to either use DMZ on the ISPs router or portforward the port to your Mikrotik as well...
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 2:22 pm

/ip address
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
Assign the Address on your Bridge interface and not in the Slave ether 2 Interface...

Also your Mikrotik Router is Behind NAT... Your Public IP Address is at your ISP's Router...
You have to either use DMZ on the ISPs router or portforward the port to your Mikrotik as well...
So basically my ISP's IP address is my router's IP address? So my ISP is like a big router for other routers in my area? I guess using DMZ on the ISP's router and portforwarding my Mikrotik both involve contacting my ISP, right? Correct me if I understood something wrong. One more question: which tab should I use to find out the Address on my Bridge interface? Thanks in advance
 
anav
Forum Guru
Forum Guru
Posts: 3605
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 2:56 pm

This is not the complete config...................... need all rules.

(1) As noted.......
/ip address
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0

/ip address
add address=192.168.88.1/24 interface=bridgeLocal network=192.168.88.0

(2)
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN (OKAY)
add action=dst-nat chain=dstnat dst-address=x.x.x.x dst-port=54000 \ (NOT OKAY)
protocol=tcp to-addresses=192.168.88.254

Format
add action=dst-nat chain=dstnat in-interface-list=WAN protocol=tcp dst-port=54000 \
to-addresses=192.168.88.254
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 3:35 pm

(2)
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN (OKAY)
add action=dst-nat chain=dstnat dst-address=x.x.x.x dst-port=54000 \ (NOT OKAY)
protocol=tcp to-addresses=192.168.88.254

Format
add action=dst-nat chain=dstnat in-interface-list=WAN protocol=tcp dst-port=54000 \
to-addresses=192.168.88.254
So I have to change
a.png
this

And type this:
b.png
in the terminal?
This is not the complete config...................... need all rules.
I followed your instructions, is the config file not complete because I used the hide sensitive info flag? Anyway, I tried what you suggested and checked if it helped on this site: https://www.yougetsignal.com/tools/open-ports/. It didn't help. Is it even safe to use this for checking?
You do not have the required permissions to view the files attached to this post.
 
anav
Forum Guru
Forum Guru
Posts: 3605
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 4:13 pm

I am sure that port checker is fine, I use grc.com and Shields UP function for my testing.
https://www.grc.com/x/ne.dll?bh0bkyd2
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
anav
Forum Guru
Forum Guru
Posts: 3605
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 4:16 pm

For example there were no firewall filter rules in the previous config.
For example in your config they should show up BEFORE the firewall NAT rules.

Try this again...........
/export hide-sensitive file=anyname.

In winbox go to the windows terminal menu choice and type the above
In winbox go to the files menu choice find the file and right click download to PC
On pc use notepadd++ to open the file copy and paste it in here.
Use the code brackets (above black square with white square brackets)
Before submitting ensure you remove your actual wanip with x.x.x.x.x
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 5:51 pm

Unless you use PPPoE on your Mikrotik or you have statically assigned a public IP Address on your Mikrotik Device, eg on ether1 then the Public IP adress is on your ISPs Router not on Mikrotik...
So if for example the public IP is x.y.z.w and the port you use for the port forward rule is 54000, if you hit that from outside your lan x.y.z.w:54000, this will go directly to your ISPs router that does know anything about it or what should do with it. So simply it will not work... if you check that with a port scanner it will appear as closed or filtered...
If you use DMZ on your ISPs router then everything is portforwarded on your Mikrotik.
Or you should portforward manually like this:
If you Mikrotik has the IP 192.168.1.2/24 though DHCP or statically on ether1, then from your ISPs router you should port forward the port 54000 to 192.168.1.2, meaning your Mikrotik.
Then on your Mikrotik you portforward again the port 54000 to the actual device inside your LAN, lets say 192.168.2.20...
ISP -> Mikrotik -> Lan Device
Last edited by Zacharias on Tue Mar 24, 2020 7:08 pm, edited 1 time in total.
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 6:56 pm

OK, I see. Here is the one WITH the firewall rules:
# mar/24/2020 19:54:29 by RouterOS 6.46.2
# software id = 43JG-2Y1F
#
# model = RB760iGS
# serial number = A36A0AC106FF
/interface bridge
add admin-mac=74:4D:28:AF:9F:1E auto-mac=no comment=defconf name=bridgeLocal
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=dhcp ranges=192.168.88.3-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridgeLocal name=dhcp1
/interface bridge port
add bridge=bridgeLocal comment=defconf disabled=yes interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
add bridge=bridgeLocal comment=defconf interface=ether3
add bridge=bridgeLocal comment=defconf interface=ether4
add bridge=bridgeLocal comment=defconf interface=ether5
add bridge=bridgeLocal comment=defconf interface=sfp1
/interface detect-internet
set wan-interface-list=all
/interface list member
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=sfp1 list=LAN
add interface=bridgeLocal list=LAN
/ip address
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
add address=192.168.88.1/24 interface=bridgeLocal network=192.168.88.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 gateway=192.168.88.1 netmask=24
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=54000 in-interface=bridgeLocal \
    protocol=tcp to-addresses=192.168.88.254
add action=masquerade chain=srcnat out-interface-list=WAN
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 7:10 pm

Please delete this line
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
And take a look at my previous post... it is really easy....
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 7:16 pm

Unless you use PPPoE on your Mikrotik or you have statically assigned a public IP Address on your Mikrotik Device, eg on ether1 then the Public IP adress is on your ISPs Router not on Mikrotik...
So if for example the public IP is x.y.z.w and the port you use for the port forward rule is 54000, if you hit that from outside your lan x.y.z.w:54000, this will go directly to your ISPs router that does know anything about it or what should do with it. So simply it will not work... if you chekc that with a port scanner it will appear as closed or filtered...
If you use DMZ on your ISPs router then everything is portforwarded on your Mikrotik.
Or you should portforward manually like this:
If you Mikrotik has the IP 192.168.1.2/24 though DHCP or statically on ether1, then from your ISPs router you should port forward the port 54000 to 192.168.1.2, meaning your Mikrotik.
Then on your Mikrotik you portforward again the port 54000 to the actual device inside your LAN, lets say 192.168.2.20...
ISP -> Mikrotik -> Lan Device
I think you are assuming that I have another router, that was brought to me by the ISP, and my MikroTik is connected to it, but actually, the external internet cable is plugged into my MikroTik and then I have my computer, which is connected to my MikroTik, directly. So I don't have an ISP router, I replaced it with my MikroTik. Or are you talking about something else? I really don't know, I might be wrong
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 7:23 pm

Please delete this line
add address=192.168.88.1/24 interface=ether2 network=192.168.88.0
And take a look at my previous post... it is really easy....
It is my second router, which is connected to my MikroTik, which gives my portable devices to connect to the internet via Wi-Fi. Just tried removing that address, my WI-FI stopped working but I fixed that (added that address again)
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 7:27 pm

ok i see...
So, the IP address assigned to you at ether1, is it a Public IP address or a private one ?
Since you might not know how to recognise that, if you are using the default firewall, ICMP (ping) is allowed, check if you can ping your ether1 IP adress through another Device outside your LANm lets say from your phone using 3G/4G...
If not then you are assigned a private IP Adress and i guess you should contact your ISP... your Mikrotik will not be reachable through the Internet...
It is my second router, which is connected to my MikroTik, which gives my portable devices to connect to the internet via Wi-Fi. Just tried removing that address, my WI-FI stopped working but I fixed that (added that address again)
Understood, but this is wrong... i will not explain why but that proves you obviously have wrong configuration on your second router too...
 
mkx
Forum Guru
Forum Guru
Posts: 3918
Joined: Thu Mar 03, 2016 10:23 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 7:32 pm

If the config you posted a few posts up is really complete, then your router is currently highly vulnerable as it has nothing in IP -> firewall -> filter . If that's really so, I highly recommend you to perform reset to factory defaults.

A question related to your discussion with @zacharias: if you go to IP > addresss, what kind of address does it show at ether1? Kindly type it here, the first two dotted numbers will suffice (e.g. 46.81.x.y).
BR,
Metod
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 7:56 pm

If the config you posted a few posts up is really complete, then your router is currently highly vulnerable as it has nothing in IP -> firewall -> filter. If that's really so, I highly recommend you to perform reset to factory defaults.

A question related to your discussion with @zacharias: if you go to IP > address, what kind of address does it show at ether1? Kindly type it here, the first two dotted numbers will suffice (e.g. 46.81.x.y).
I think my MikroTik is already factory reset, at least I did it three or four months ago.
f.png
I mean, it's definitely not a private IP address, as far as I can tell, but the address shown on ether1 doesn't match the IP address that https://whatismyipaddress.com/ is showing. Why?
b.png
I am so sorry I don't understand everything, but I am trying. Thanks for trying to help me out, guys
You do not have the required permissions to view the files attached to this post.
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:00 pm

The IP address on your ether1 is a private IP adress, meaning not Public... not reachable through the Internet...
The second address, from the photo is a public one and is the address of your ISPs equipment wherever that is...
And ofcorse, i havent checked, if you do not use any firewall as @mkx stated, fix it as soon as possible....
 
mkx
Forum Guru
Forum Guru
Posts: 3918
Joined: Thu Mar 03, 2016 10:23 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:16 pm

As @zacharias noted: your USP is definitely performing NAT and yiu can't get any port forwarded from internet to your LAN without talking to your ISP.

Re firewall: doesn't matter if you did factory reset a few weeks ago, currently you don't have any firewall ... and IMHO there should be one, hence my recomendation. And don't remove it, default firewall rules automatically take NAT rules into account hence default firewall filter rules are not reason for port forwarding to not work.
BR,
Metod
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:19 pm

The IP address on your ether1 is a private IP adress, meaning not Public... not reachable through the Internet...
The second address, from the photo is a public one and is the address of your ISPs equipment wherever that is...
And ofcorse, i havent checked, if you do not use any firewall as @mkx stated, fix it as soon as possible....
So, basically I have to contact my ISP for them to forward a port to my router?
 
mkx
Forum Guru
Forum Guru
Posts: 3918
Joined: Thu Mar 03, 2016 10:23 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:26 pm

So, basically I have to contact my ISP for them to forward a port to my router?
Yes.
BR,
Metod
 
Sob
Forum Guru
Forum Guru
Posts: 5416
Joined: Mon Apr 20, 2009 9:11 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:27 pm

And you'll have to hope that they will be willing to do that. Not all are. Or you can ask for own public address, but not all ISPs have enough to be able to give you one. And when they do, they often want extra money for it.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:36 pm

If it is really important to have a Public IP on your Mikrotik then contact your ISP and buy a static IP...
The configuration of a static IP is really easy...
Till then there is nothing you can do...
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 8:47 pm

Do I have alternatives? For example, some service on the internet which will send over data for me.
 
anav
Forum Guru
Forum Guru
Posts: 3605
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 9:05 pm

To be clear, you do not have a MODEM from your ISP?
A device that accepts the fibre or cable or telephone line from the ISP that is located in your house.
From that device, do you have an ethernet cable that connects to your mikrotik router?

IF you do not have the above, what do you have??
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Tue Mar 24, 2020 9:14 pm

A device that accepts the fibre or cable or telephone line from the ISP that is located in your house.
No, I don't have any ISP equipment, the outside internet cable is directly plugged into the MikroTik
 
Sob
Forum Guru
Forum Guru
Posts: 5416
Joined: Mon Apr 20, 2009 9:11 pm

Re: I can't port forward my hexS MikroTik router. Help  [SOLVED]

Wed Mar 25, 2020 1:57 am

I'd ask ISP first, maybe you'll be lucky. My home ISP provides public address at request at no extra cost. When I asked if I'd be too spoiled if I wanted two, the answer was that it's no problem and second address is free too. Sometimes I wonder how far I could push it. ;) The usual experience with other ISPs is much worse, but you never know.

Forwarding ports from elsewhere is also possible. You can either get VPS with public address and do it yourself, or find some existing service. Some VPN providers probably support it. And when I asked Google for "free port forward" (some better keywords could help, most results are about configuring routers), I got https://portmap.io/ and there are probably others.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
anav
Forum Guru
Forum Guru
Posts: 3605
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: I can't port forward my hexS MikroTik router. Help

Wed Mar 25, 2020 3:14 pm

So Sob, what are you saying here?
That we should all throw away our ISP modems because its all a trick. There is no need for an intermediary device to translate the fiber, cable or dsl from the street into an ethernet signal coming out of the modem. Please let me know what I have to do on my MT.
I'd rather manage rats than software. Follow my advice at your own risk! (Sob & mkx forced me to write that!)
 
Sob
Forum Guru
Forum Guru
Posts: 5416
Joined: Mon Apr 20, 2009 9:11 pm

Re: I can't port forward my hexS MikroTik router. Help

Wed Mar 25, 2020 10:41 pm

I think you may be mixing two things together. One is whether ISP gives you dedicated public address or not. And second one, if they do, where exactly the address is.

Worst case is when there's no public address for you. You still use one (or even more) to access internet (it wouldn't work without it), but it's not yours, it's shared with several other people. This is almost hopeless. Some ISPs may try and at least forward few ports to you. But many don't bother. And even if they are willing, it's limited, because e.g. if there's only one address and more people want port 80, only one can have it.

Better is when you have address for yourself, but even then there are different levels. Many ISPs use NAT 1:1, where you don't really have the address, but they only forward all ports to you. It's far from ideal, because it changes behaviour of some things, e.g. IPSec.

Another option is when they give you their router/modem, it has the address and you're connected behind it. So the address is a little closer to you, but it doesn't change much, because your router is still behind NAT.

Best case is when you have public address directly on your router. Depending on used technology, you can either ditch ISP router/modem completely, or some can be switched to transparent bridge mode, so the device is there, but it's not routing and not doing NAT.
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply. Not intended as incentive for masochists.
 
gorgo176
just joined
Topic Author
Posts: 12
Joined: Mon Mar 23, 2020 2:32 pm

Re: I can't port forward my hexS MikroTik router. Help

Fri Mar 27, 2020 5:04 pm

So I finally managed to get this thing working:
a.png
(Yeah, I bought a static IP)
How do I rename the topic to address the carrier-grade NAT issues?
Anyway, I just wanted to thank everyone who replied :)
You do not have the required permissions to view the files attached to this post.
 
Zacharias
Forum Guru
Forum Guru
Posts: 1603
Joined: Tue Dec 12, 2017 12:58 am
Location: Greece

Re: I can't port forward my hexS MikroTik router. Help

Fri Mar 27, 2020 5:12 pm

Then that makes my answer as solution to your post at #23...
If it is really important to have a Public IP on your Mikrotik then contact your ISP and buy a static IP...
:) :) :)
Also please hide your Public IP...

Who is online

Users browsing this forum: Bing [Bot], xins and 94 guests