0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none 
 1    chain=srcnat action=masquerade out-interface=ether1 
 2    chain=dstnat action=dst-nat to-addresses=192.168.1.23 to-ports=5522 protocol=udp dst-port=5522 log=no log-prefix="" 
 3    chain=dstnat action=dst-nat to-addresses=192.168.1.23 to-ports=5060 protocol=udp dst-port=5060 log=no log-prefix="SIP" 
 4    chain=dstnat action=dst-nat to-addresses=192.168.1.23 to-ports=5061 protocol=udp dst-port=5061 log=no log-prefix="SIP" 
 5    chain=dstnat action=dst-nat to-addresses=192.168.1.23 to-ports=8100-8300 protocol=udp dst-port=8100-8300 log=no log-prefix="" 
 6 X  ;;; 10000-20000
      chain=dstnat action=dst-nat to-addresses=192.168.1.23 to-ports=10000-20000 protocol=udp dst-port=10000-20000 log=no

[2017-11-27][13:32:46.814] REGISTER 12 headers, 0 lines
[2017-11-27][13:32:46.817] .--------------- --- -- -
[2017-11-27][13:32:46.820] | SIP Reliably Transmitting (NAT) to 89.209.199.9:5060
[2017-11-27][13:32:46.828] |----------- --- -- -
[2017-11-27][13:32:46.831] | REGISTER sip:89.209.199.9 SIP/2.0
[2017-11-27][13:32:46.834] | Via: SIP/2.0/UDP 192.168.1.23:5060;
[2017-11-27][13:32:46.856] | CSeq: 106 REGISTER
[2017-11-27][13:32:46.897] | Event: registration
[2017-11-27][13:32:46.901] | Content-Length: 0
[2017-11-27][13:32:46.910] `------ --- -- -
[2017-11-27][13:32:47.808] .--------------- --- -- -
[2017-11-27][13:32:48.052] | SIP Retransmitting #1 (NAT) to 89.209.199.9:5060
[2017-11-27][13:32:48.056] |----------- --- -- -
[2017-11-27][13:32:48.060] | REGISTER sip:89.209.199.9 SIP/2.0
[2017-11-27][13:32:48.064] | Via: SIP/2.0/UDP 192.168.1.23:5060;
[2017-11-27][13:32:48.081] | CSeq: 106 REGISTER
[2017-11-27][13:32:48.102] | Event: registration
[2017-11-27][13:32:48.109] | Content-Length: 0

You shouldn't need to do anything special, no special firewall rules, no special nat rules, for things to work. Do turn of MikroTik's SIP ALG feature (ip / firewall / service ports, then disable SIP).
Your PBX should have some settings for NAT which will keep an open connection over UDP to your provider.

So I assume that my NAT rules are fine?

/ip firewall filter
add chain=input action=accept connection-state=established,related comment="Accept established related"
add chain=input action=accept in-interface=bridge-LAN comment="Allow LAN access to router and Internet"
add chain=input action=drop comment="Drop all other input"
add chain=forward action=accept connection-state=established,related comment="Accept established related"
add chain=forward action=accept connection-state=new in-interface=bridge-LAN comment="Allow LAN access to router and Internet"
add chain=forward action=accept connection-nat-state=dstnat comment="Allow Port forwards"
add chain=forward action=drop comment="Drop all other forward"

/ip firewall nat
add chain=srcnat action=masquerade out-interface=ether-WAN comment="Default masq"
add chain=dstnat action=dst-nat in-interface=ether-WAN protocol=tcp to-addresses=1.2.3.4 dst-port=123 to-ports=123 comment="Sample Port Forward"

Don't see any interfaces on your dst nat rules, add your WAN interface as "in" interface on these rules

The problem is that I often have SIP registration problem to my remote SIP provider.

Don't see any interfaces on your dst nat rules, add your WAN interface as "in" interface on these rules

Don't see any interfaces on your dst nat rules, add your WAN interface as "in" interface on these rules

...
Should that one:
https://wiki.mikrotik.com/wiki/Manual:I ... forwarding

be updated?

If I understand you correctly, then it is the same thing, except they are using the IP Address of the WAN interface

/ip firewall nat add chain=dstnat \
protocol=tcp dst-port=1234 \
action=dst-nat to-address=192.168.1.1 to-port=1234

If I understand you correctly, then it is the same thing, except they are using the IP Address of the WAN interface

Unfortunately, they don't:

Code: Select all

/ip firewall nat add chain=dstnat \
protocol=tcp dst-port=1234 \
action=dst-nat to-address=192.168.1.1 to-port=1234

The to-address defines the new value, dst-address would match the original one but it is missing. So the rule really matches packets coming in via any interface and to any destination address. I'm afraid nobody thought about peer2peer protocol which listens on port X but also sends its requests to the same port X when writing the documentation.

For most use cases where usual client/server protocols are involved this omission doesn't cause any issues. And the less conditions to evaluate, the faster the rule processing. So if I'd be modifying the documentation, I'd add this as a warning but wouldn't put the additional condition into the example.

/ip firewall nat
add chain=dstnat dst-address=10.5.8.200 dst-port=21 protocol=tcp action=dst-nat to-addresses=192.168.0.109

I was referring to the rule below on wiki

Code: Select all

/ip firewall nat
add chain=dstnat dst-address=10.5.8.200 dst-port=21 protocol=tcp action=dst-nat to-addresses=192.168.0.109

Hi, does the order of rules matters?

The "to-ports=" is also taken from documentation.