Hello everyone!

I'm a newly baked MikroTik user, and I'm asking for help with this really basic, but challenging for me task of setting the router to allow my computer to be accessed via VNC from outside world.

I'm using the new MikroTik LMT LTE18 router, with RouterOS v7.0.

I've watched videos on the internet and read topics on this forum on the subject, tried to follow this topic here, but still was not able to achieve the goal.


Please advise on how to open access for the outside world to VNC server on 192.168.8.254 port 8426 that is connected to the router by Wi-Fi.

Below I am attaching some relevant screenshots (click for the full-size image).

List of interfaces:



Default firewall filter rules:



Default firewall NAT:




Thank you for your time!

Hello!

Do I correctly understand that you want to make a port forwarding to server which is in your LAN network?
If so , you can find a manual for dst-nat here:
https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

Best Regards,

Do you have public IP address on LTE interface? Or from 10.0.0.0/8 network (smth like 10.44.28.53)?

Try to ask the LMT operator for real Public IP. Maybe they offer you this as well:
https://bizness.lmt.lv/en/real-ip-address

So many replies — thank you all!

Do I correctly understand that you want to make a port forwarding to server which is in your LAN network?
If so , you can find a manual for dst-nat here:
https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/NAT

Yes, correct.

This is quite an advanced topic for me, and unforutnately I did not succeed in reaching my goal from following videos and tutorials on this subject elsewhere.

I hoped that someone could mention a specific set of rules for my device.

Paul, does the mobile operator give you a public IP ? Most likely not, so regardless of the router used, your device will not be accessible from the outside.

Try to ask the LMT operator for real Public IP. Maybe they offer you this as well:
https://bizness.lmt.lv/en/real-ip-address

I don't have a static/fixed IP, but I don't think it is a must, and my MikroTik router even has a built-in DDNS feature.



Just before switching to the MikroTik LMT LTE18 router, I had a simple Huawei LTE router (mobile operator TELE2, with dynamic IP), and I was connecting to my computer with VNC server, via a free DDNS service, without issues.

Huawei router was dumb enough for me to configure port forwarding, but MikroTik is too smart for my skill

Do you have public IP address on LTE interface? Or from 10.0.0.0/8 network (smth like 10.44.28.53)?

Yes, please see below:

So you haven't public IP address, this IP is from LMT internal network for clients, which is behind some NAT. Because they haven't dst-nat from real public IP to your router's external LTE interface, you can't establish VNC connection. You should ask LMT for real public IP. It can be dynamic, you can use DDNS.

There is the following IP in the "Cloud" settings menu:



Below is information from my computer's app:

My previous setup (before the MikroTik router) was as follows:


• Huawei LTE router, which had an easy menu where I could open a port for the VNC server;



• dynamic IP by TELE2 mobile operator provider;

• No-IP service (noip.com) that, for free, assigned the xxxx.hopto.org hostname to my dynamic IP.


And I easily connected to my computer from another computer via VNC.



Could you please advise (in a broad sense) how the MikroTik/RouterOS are different from a standard consumer router like my old Huawei, for something like I described above not to work without the static/fixed IP or an additional router?


Thank you!

Previously you had dynamic, but still public IP. Obviously.
Now, your IP is private (doesn't even matter it it is static or dynamic).
Without public IP it won't work on any router.

Oh, so it is the Internet connection service that is the issue here.

Thank you all for taking your time to get this message through my skull.

I will enquire with my internet service provider about the public IP option.

Hopefully it would be possible to add this option, and then I'll be back with my question about the settings for the device; hopefully you would not mind me bugging you again with this

This whole thread seems a bit pointless, because you really don't want to be running an unencrypted protocol with poor security open to the world in the first place.
Unless you want to get hacked or have information stolen of course...

Security is of primary concern. I'm using RealVNC server and client, and this combo provides 256-bit AES encryption.

Hello again everyone!

The mobile service provider added the GPRS Plus option to my connection, and my router now has a public IP address, like so:




Thank you normis for your strong suggestion about the VPN tunnel, but for the moment I have only one router.

As such, it would be awesome if someone could please advise about the rules for my device to open access for the outside world to VNC server on 192.168.8.254 port 8426 that is connected to the router by Wi-Fi. I have posted a picture with the device's interfaces in the 1st post, as well as pictures with the default rules.

Thank you very much for your time!

but for the moment I have only one router.

You don't need another one.
You establish VPN connection from a remote PC to your router, and then you run VNC inside VPN.
That is the secure way to do that.

xvo thank you for the information!

I will try to find information how to do it.

Meanwhile, I was able to do the basic port forwarding (and consequently VNC) with this tutorial (just substituted the port number, IP address, and the interface (to "lte1")). I also added an exact same rule also for the "udp" protocol, as RealVNC prefers it over the "tcp" protocol.

is there software updates avalable for LTE18 ?

@lvlaster there is an update on the beta channel:

@lvlaster there is an update on the beta channel:

For now only at development channel with ros7.1beta2 .
We know that MikroTik works at ros7.x tree of RouterOS and you can check status at: https://help.mikrotik.com/docs/display/ ... col+Status where they currently working at ros7.1beta3 and they have many stuff to do...

I think in 2021 we can reach first release candidate versions.
Remember you cannot back to 6.x RouterOS family.