Community discussions

MUM Europe 2020
 
ashmodai
just joined
Topic Author
Posts: 22
Joined: Thu Jul 21, 2011 12:48 pm

Port forwarding issue :-) Getting crazy please help me !

Thu Jul 28, 2011 3:31 pm

I am trying to do something that sounds really easy : forward ports from the internet to specific machines on my lan. I do have a dynamic ip so I look thru these forums and I used the advises proposed but ... it still does not work :-(

Here are my settings:
My wan is on eth1 and is called "wan1"
My lan is bridged from eth2-5 with eth2 master port (local ip : 192.168.6.4/24)

NAT:

0 chain=srcnat action=masquerade out-interface=wan1

1 chain=dstnat action=dst-nat to-addresses=192.168.6.101 to-ports=80
protocol=tcp in-interface=wan1 dst-port=80

2 chain=dstnat action=dst-nat to-addresses=192.168.6.101 to-ports=443
protocol=tcp in-interface=wan1 dst-port=443

FILTERS:

0 ;;; allow established
chain=input action=accept connection-state=established

1 ;;; allow related
chain=input action=accept connection-state=related

2 ;;; drop invalid traffic
chain=input action=drop connection-state=invalid

3 ;;; Allow everything from lan
chain=input action=accept in-interface=bridge

4 ;;; allow everything from lan
chain=input action=accept in-interface=ether2-local

5 ;;; SSH to router itself
chain=input action=accept protocol=tcp dst-port=22

6 ;;; drop everything else
chain=input action=drop

7 ;;; forward established traffic

chain=forward action=accept connection-state=established

8 ;;; forward related traffic
chain=forward action=accept connection-state=related

9 ;;; forward traffic from LAN to WAN
chain=forward action=accept out-interface=wan1

10 ;;; allow public services
chain=forward action=accept protocol=tcp dst-address=192.168.6.101
dst-port=80,443

11 ;;; drop everything else
chain=forward action=drop

12 ;;; drop invalid traffic
chain=forward action=drop connection-state=invalid


With these settings I can access SSH from the outside but my forwards do not work :-( Please help me ....
 
poli5681
newbie
Posts: 44
Joined: Fri Jul 03, 2009 11:47 am

Re: Port forwarding issue :-) Getting crazy please help me !

Thu Jul 28, 2011 3:49 pm

Filtering is done before NAT; Meaning you have to use a filter-rule like this:

10 ;;; allow public services
chain=forward action=accept protocol=tcp in-interface=ether1
dst-port=80,443

or

10 ;;; allow public services
chain=forward action=accept protocol=tcp dst-address=YOUR-WAN-IP
dst-port=80,443
 
ashmodai
just joined
Topic Author
Posts: 22
Joined: Thu Jul 21, 2011 12:48 pm

Re: Port forwarding issue :-) Getting crazy please help me !

Thu Jul 28, 2011 4:19 pm

Hi and Thanks for the impressively quick answer ! Not sure to get what you mean ?
Are you saying I should replace my existing rule 10

10 ;;; allow public services
chain=forward action=accept protocol=tcp dst-address=192.168.6.101
dst-port=80,443

by your version ?

10 ;;; allow public services
chain=forward action=accept protocol=tcp in-interface=ether1
dst-port=80,443

basically removing the dst-address component and adding the in-interface instead? I tried to do this and it does not work. If I look at the router I see in both cases that the rule is matching some packets (the counter moves slowly) but it does not work :-(
 
poli5681
newbie
Posts: 44
Joined: Fri Jul 03, 2009 11:47 am

Re: Port forwarding issue :-) Getting crazy please help me !

Thu Jul 28, 2011 4:26 pm

Yes, i´d recommend setting the interface instead of the local IP in rule 10.

Anyway i just noticed, that your rule should work (according to the packet flow diagram in the wiki).
I just tried on my own and it works.

Does it work, if you remove your final drop rule (Nr. 11)?
 
kirshteins
MikroTik Support
MikroTik Support
Posts: 592
Joined: Tue Dec 02, 2008 10:55 am

Re: Port forwarding issue :-) Getting crazy please help me !

Thu Jul 28, 2011 4:32 pm

Make sure you have enabled "use-ip-firewall" in bridge settings. Also test with firewall rules disabled.
 
ashmodai
just joined
Topic Author
Posts: 22
Joined: Thu Jul 21, 2011 12:48 pm

Re: Port forwarding issue :-) Getting crazy please help me !

Thu Jul 28, 2011 5:01 pm

I am totally ashamed ... I was happy to discover that the option "use-ip-firewall" was not enabled in bridge settings but it still did not work after ... What was getting me crazy was to see the packets matching the rules properly but still ... then I realized that I am just a stupid moron ... I was testing my brand new rg450 with still my old router/firewall in place in order to make sure everything would be working before replacing my old cisco but guess what ... my gateway was still the old router on the machine I was trying to reach ... explaining quite clearly why packets were getting in but never out again ... Changing the gw resolved the issue.

Thanks a lot to both poli5681 and kirshteins for their very quick support and shame on me :-)

Who is online

Users browsing this forum: No registered users and 36 guests