Community discussions

MikroTik App
 
tjohansen
just joined
Topic Author
Posts: 3
Joined: Fri Jul 09, 2021 12:21 pm

Cant get port forwarding to work

Fri Jul 09, 2021 1:03 pm

its a basic setup, I have created the the NAT rules in firewall as guided in several post here on the forum, but wont work.

The router is attached after a fiber box (isp), the fiber box should be in bridge mode, according to the ISP.

the router runs in mode "router"
on port ETh1
it gets a WAN 100.xxx.xxx.161
netmask 255.255.254.0
GW 100.xxx.xxx.1

but testing my public ip address its: 83.xxx.xxx.91
I can ping google etc.


The NAT rule:

chain:dstnat
prototol: 6(tcp)
dst.port: 8081
In.interface: ether1

action:dst-nat
to Addresses: 192.168.88.254
to ports: 8081


anyone who can see what im doing wrong?

Here is the router conf:
/interface bridge
add admin-mac=2C:C8:1B:69:35:DF auto-mac=no comment=defconf name=bridge
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=sfp1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=192.168.88.0
/ip dhcp-client
add comment=defconf disabled=no interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=8081 in-interface=ether1 protocol=tcp to-addresses=192.168.88.254 to-ports=8081
/system clock
set time-zone-name=Europe/Copenhagen
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
 
tdw
Forum Guru
Forum Guru
Posts: 1843
Joined: Sat May 05, 2018 11:55 am

Re: Cant get port forwarding to work  [SOLVED]

Fri Jul 09, 2021 1:41 pm

Likely your ISP is using CGNAT to reduce the number of public IPv4 addresses they require, where multiple clients with 'WAN' addresses in the range 100.64.0.0 - 100.127.255.255 share a single public IP.

Port forwarding is not possible with this, you will have to ask your ISP if they can provide public IP addresses - some are not able to, others may charge for one.
 
tjohansen
just joined
Topic Author
Posts: 3
Joined: Fri Jul 09, 2021 12:21 pm

Re: Cant get port forwarding to work

Fri Jul 09, 2021 1:46 pm

thx, I think you are right.
 
tjohansen
just joined
Topic Author
Posts: 3
Joined: Fri Jul 09, 2021 12:21 pm

[solved] Cant get port forwarding to work

Fri Jul 09, 2021 4:15 pm

I can confirm it was the CGNAt problem.
After getting static WAN address it all worked.

Thx for guiding me in the correct direction.

Who is online

Users browsing this forum: Ahrefs [Bot], Amazon [Bot], Bing [Bot], lktompkins and 23 guests