Hi.
Tell me please what wrong with my configuration?
I need port forwarding (2302, 2305) and this config not working, but should, maybe.
And can someone give some advice on how to improve my firewall rules if necessary.
Sorry, my English not perfect.
Thx.
Port forwarding and firewall improvements
You do not have the required permissions to view the files attached to this post.
Re: Port forwarding and firewall improvements
The simplest method to do port forwarding is this:
However it doesn't work from LAN, only from the internet.
Would be awesome if an expert could tell us how to do proper port forwarding, with access from LAN, without client IP address getting replaced with router's.
Code: Select all
/ip firewall nat
add action=dst-nat chain=dstnat in-interface-list=WAN dst-port=2302 protocol=tcp to-addresses=192.168.88.101
add action=dst-nat chain=dstnat in-interface-list=WAN dst-port=2302 protocol=udp to-addresses=192.168.88.101
add action=dst-nat chain=dstnat in-interface-list=WAN dst-port=2305 protocol=tcp to-addresses=192.168.88.101
add action=dst-nat chain=dstnat in-interface-list=WAN dst-port=2305 protocol=udp to-addresses=192.168.88.101Would be awesome if an expert could tell us how to do proper port forwarding, with access from LAN, without client IP address getting replaced with router's.
Re: Port forwarding and firewall improvements
It doesn't work from LAN because of in-interface-list=WAN. To fix it, replace it with dst-address=<your public address> (if you have static address). If you have dynamic address, you can use dst-address-type=local. If it's for port that is also used for service on router (for example, you may need <public address>:80 for your webserver, but also <internal address>:80 for WebFig at the same time), add additional dst-address=!<internal address> to exclude it ("!" means "not").
If your internal server sees router's address instead of real client's address, you need to fix your srcnat rule(s). Common mistake is unconditional masquerade rule, but you actually want it only for traffic to internet, so it should have out-interface-list=WAN. Then if access from LAN should work, you need another srcnat rule for hairpin NAT. Simple one can be:
If your internal server sees router's address instead of real client's address, you need to fix your srcnat rule(s). Common mistake is unconditional masquerade rule, but you actually want it only for traffic to internet, so it should have out-interface-list=WAN. Then if access from LAN should work, you need another srcnat rule for hairpin NAT. Simple one can be:
Code: Select all
/ip firewall nat
add chain=srcnat src-address=<local subnet> dst-address=<local subnet> action=masqueradeRe: Port forwarding and firewall improvements
And for OP, if you didn't make a mistake and only tested it from LAN (which wouldn't work), are you sure that you have public IP address?
Re: Port forwarding and firewall improvements
Hi.
Thank you very much for so many answers.
I'm confused.
I will explain the essence of my problem, it is trivial.
I set up a dedicated server on my computer for the game. This server requires two ports. Accordingly, I want these ports to be forwarded from the local network to the outside and back.
I have a static IP.
In total, I applied the settings that you advised, the NAT settings now look like this:
Looking ahead, I will say that I tried to change the incoming interface to the WAN list in the rules. It does not work either with him or without him.
Server, according to my static IP, is still unavailable, therefore the ports are still not forwarded.
I guess I made a mistake in setting up the masquerade, because right now how the masquerade works is the biggest mystery to me right now.
Please tell me where I made a mistake and what I have not yet understood?
Thx.
Thank you very much for so many answers.
I'm confused.
I will explain the essence of my problem, it is trivial.
I set up a dedicated server on my computer for the game. This server requires two ports. Accordingly, I want these ports to be forwarded from the local network to the outside and back.
I have a static IP.
In total, I applied the settings that you advised, the NAT settings now look like this:
Code: Select all
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat dst-address=192.168.88.0/24 src-address=192.168.88.0/24
add action=netmap chain=dstnat dst-address=STATIC_IP dst-port=2302 protocol=tcp to-addresses=192.168.88.101 to-ports=2302
add action=netmap chain=dstnat dst-address=STATIC_IP dst-port=2302 protocol=udp to-addresses=192.168.88.101 to-ports=2302
add action=netmap chain=dstnat dst-address=STATIC_IP dst-port=2305 protocol=tcp to-addresses=192.168.88.101 to-ports=2305
add action=netmap chain=dstnat dst-address=STATIC_IP dst-port=2305 protocol=udp to-addresses=192.168.88.101 to-ports=2305
Looking ahead, I will say that I tried to change the incoming interface to the WAN list in the rules. It does not work either with him or without him.
Server, according to my static IP, is still unavailable, therefore the ports are still not forwarded.
I guess I made a mistake in setting up the masquerade, because right now how the masquerade works is the biggest mystery to me right now.
Please tell me where I made a mistake and what I have not yet understood?
Thx.
Re: Port forwarding and firewall improvements
Two questions:
- Is your STATIC_IP same as you see at https://wtfismyip.com/clean?
- If you look at dstnat rules' counters, if there anything or just zeroes?
Other than that, you can use action=dstnat instead of action=netmap (there doesn't seem to be a difference, but dstnat is more common), and you don't have to add to-ports when the port is same as in dst-port.
Masquerade is simple. First rule takes care of LAN->internet connections. Second one is for LAN->LAN connections, in case you'd connect to STATIC_IP from LAN.
- Is your STATIC_IP same as you see at https://wtfismyip.com/clean?
- If you look at dstnat rules' counters, if there anything or just zeroes?
Other than that, you can use action=dstnat instead of action=netmap (there doesn't seem to be a difference, but dstnat is more common), and you don't have to add to-ports when the port is same as in dst-port.
Masquerade is simple. First rule takes care of LAN->internet connections. Second one is for LAN->LAN connections, in case you'd connect to STATIC_IP from LAN.
Re: Port forwarding and firewall improvements
- Yes.- Is your STATIC_IP same as you see at https://wtfismyip.com/clean?
- If you look at dstnat rules' counters, if there anything or just zeroes?
- All counters just zeros. No packets, no bytes. But the new masquerade rule still captured a couple of packets, but not when I ping the port from the outside.
I know the difference, I'm just trying to set it up as accurately as possible so that it works at least to begin with. Therefore, I will do the optimization.Other than that, you can use action=dstnat instead of action=netmap (there doesn't seem to be a difference, but dstnat is more common), and you don't have to add to-ports when the port is same as in dst-port.
Thank you, it became clearer.Masquerade is simple. First rule takes care of LAN->internet connections. Second one is for LAN->LAN connections, in case you'd connect to STATIC_IP from LAN.
Thx, already read it, but still not understand what i do wrong.
You do not have the required permissions to view the files attached to this post.
Re: Port forwarding and firewall improvements
But judging by the screenshot and the rule added by UPnP, you don't have STATIC_IP directly on router (in IP->Addresses), right? If not and you actually have just NAT 1:1, dstnat rules with dst-address=STATIC_IP won't work for connections from internet. You can use dst-address=192.168.100.2 and see it that helps. Or in-interface=ether1, if you tried that before, should have worked too.
Re: Port forwarding and firewall improvements
Before I started changing the NAT settings, my rules were configured for the interface ether1.
And yes, most surprisingly, the UPnP rules work, and registered packets and bytes.
I will describe my network as it actually is.
And yes, most surprisingly, the UPnP rules work, and registered packets and bytes.
I will describe my network as it actually is.
You do not have the required permissions to view the files attached to this post.
Re: Port forwarding and firewall improvements [SOLVED]
If you don't need hairpin NAT, i.e. the ability to connect to STATIC_IP:<forwarded_port> from LAN (it was the other poster who mentioned it), then use:
If you do need hairpin NAT, then you can use this:
If it won't work, then there's either something wrong with your testing, or ISP forwards ports to you selectively, only some and not all.
Code: Select all
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=192.168.100.2 dst-port=2302 protocol=tcp to-addresses=192.168.88.101
...Code: Select all
/ip firewall address-list
add address=192.168.100.2 list=wan_addr
add address=STATIC_IP list=wan_addr
/ip firewall nat
add action=dst-nat chain=dstnat dst-address-list=wan_addr dst-port=2302 protocol=tcp to-addresses=192.168.88.101
...
Re: Port forwarding and firewall improvements
I didn't see a
or likewise in the export, so perhaps the traffic is droped by your firewall.
You must allow the traffic in the forward chain that you want to forward.
Code: Select all
/ip firewall filter
add action=accept chain=forward dst-port=2302 protocol=udp
add action=accept chain=forward dst-port=2302 protocol=tcp
add action=accept chain=forward dst-port=2305 protocol=udp
add action=accept chain=forward dst-port=2305 protocol=tcp
You must allow the traffic in the forward chain that you want to forward.
Re: Port forwarding and firewall improvements
No, that's not the problem.You must allow the traffic in the forward chain that you want to forward.
I do not have a single rule that blocked traffic to specific ports and addresses.
The result of this story is as follows.
My router is not connected to the Internet directly, but through an optical terminal from the provider.
Having asked the provider to configure this terminal as a bridge to my router, the problem was immediately solved.
The router can see the external static address and accordingly forward the ports to it.
I apologize for the time taken from the specialists of this form.
Thanks to all.
Re: Port forwarding and firewall improvements
Don't apologize, that's what the forum is for. Enjoy the happy end.
Who is online
Users browsing this forum: Bing [Bot] and 107 guests