Community discussions

MikroTik App
 
heviejob
Member Candidate
Member Candidate
Topic Author
Posts: 171
Joined: Mon Nov 30, 2009 4:54 pm

Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 3:58 pm

I have been using dsnat to access my linux box at my office from home using RB750G running ROS v4.11. I later added another server on the same router but on a different network. The setup worked great for over 2 months until i reinstalled the 2nd server (from fedora to ubuntu). That was yesterday. First the newly installed server could not be accessed via the ports I had forwarded (e.g port 80 i forward to port 10080- from outside) since the first server was using all standard ports. Now I cannot access the other server from home.
My question is could it be an issue with the router or someone is denying me access since the office network is also on a hotspot?
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 4:19 pm

Could be the Hotspot, depending on how you have things setup. Post your network layout and the relevant configuration.
 
heviejob
Member Candidate
Member Candidate
Topic Author
Posts: 171
Joined: Mon Nov 30, 2009 4:54 pm

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 5:09 pm

This is an overview.
Ether1-wan --> connects to isp
Ether2-hotspot1 --> connects hotspot clients network 192.168.16.0/24 and 192.168.1.0/24 for management
Ether5-hotspot2 --> connects to other hotspot network 192.168.9.0/24 and 192.168.200.0/24 for management

The first main server (192.168.1.159) is on the 192.168.1.0/24 network while the second server 1(92.168.200.159) is on 192.168.200.0/24 network
Both servers are bypassed in hotspot ip-binding settings.
I have dsnat to the main server using ports 10000,443,80,22,25
To the second server I mapped port 80 -> 10080, 443->10443, 22 ->10022

This is the firewall Nat print but I had removed nat settings for my 2nd server as i tried to trouble shoot it.

1 ;;; Mikrotik Ports
chain=dstnat action=dst-nat to-addresses=0.0.0.0 protocol=tcp
dst-address-type=local in-interface=ether1-wan
dst-port=!8291,8080,2210,2211,1723

2 ;;; server forwarding
chain=dstnat action=dst-nat to-addresses=192.168.1.159 protocol=tcp
dst-address-type=local in-interface=ether1-wan dst-port=10000,443,80,22,25

3 ;;; udp forwarding to server
chain=dstnat action=dst-nat to-addresses=192.168.1.159 protocol=udp
dst-address-type=local in-interface=ether1-wan

4 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=192.168.16.0/24
out-interface=ether1-wan

5 chain=srcnat action=masquerade src-address=192.168.100.0/24
out-interface=ether1-wan

6 chain=srcnat action=masquerade src-address=192.168.200.0/24
out-interface=ether1-wan

7 chain=srcnat action=masquerade src-address=192.168.1.0/24
out-interface=ether1-wan

8 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=192.168.8.0/24
out-interface=ether1-wan

9 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=192.168.9.0/24
out-interface=ether1-wan

10 X ;;; Squid http proxy
chain=dstnat action=dst-nat to-addresses=192.168.1.159 to-ports=3128
protocol=tcp src-address=!192.168.1.159 dst-port=80
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 5:32 pm

That looks fine as long as the IP binding bypass is implemented right.
Given that you have free ports, I'd try making a new network on ether3 that isn't covered by a Hotspot and moving the server to that new network.
 
heviejob
Member Candidate
Member Candidate
Topic Author
Posts: 171
Joined: Mon Nov 30, 2009 4:54 pm

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 5:47 pm

Ipbindings is ok and has been. I woke up today and I couldn't access the main server remotely but I can within the networks.
The second one stopped working yesterday from the blue. Am thinking its a software issue/bug to the level that the router stops forwarding ports. Is there something like a flushing the cache of the router. I cant afford a reset at the moment since customers are connected?
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 5:52 pm

The best you can do is flush all active connections via "/ip firewall connection remove [/ip firewall connection find]". That will affect people's ongoing connections, so it is interruptive.
 
heviejob
Member Candidate
Member Candidate
Topic Author
Posts: 171
Joined: Mon Nov 30, 2009 4:54 pm

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 6:28 pm

Still nothing. Even a reboot is not solving anything. It nothing works I will just reset and do a full reconfigure. Thanks anyway.
 
heviejob
Member Candidate
Member Candidate
Topic Author
Posts: 171
Joined: Mon Nov 30, 2009 4:54 pm

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 7:39 pm

The best you can do is flush all active connections via "/ip firewall connection remove [/ip firewall connection find]". That will affect people's ongoing connections, so it is interruptive.
One more question. Is it possible for natting (src or dst) to stop just like that. And if I have more than one web servers running on my private network but only have forwarded one to the internet can that cause such an issue to occur. Where would you start troubleshooting if you had such an issue?
 
fewi
Forum Guru
Forum Guru
Posts: 7717
Joined: Tue Aug 11, 2009 3:19 am

Re: Port Natting on RB750G suddenly stopped.

Fri Sep 24, 2010 7:52 pm

NATing would not just stop working without something changing, no.

Multiple web servers wouldn't cause an issue. It's all about the destination IP address in the layer 3 header of the packet. First it's the public IP address on the router, then it gets rewritten to the real private IP address on the server. It doesn't matter that there are other machines on the inside network that listen on tcp port 80.

I'd start by sniffing traffic. First on the router itself - do you see the requests coming in on the WAN interface? Are the NAT rules counting up hits? Does a firewall rule inserted in prerouting (as early as possible) explicitly permitting all traffic to a destination port of tcp/80 start counting up hits? This is to rule out issues in the cloud. Then sniff traffic on the server - do you see the traffic making it there? Does the firewall connection table show the connections you're expecting?
First cut the problem realm in half - is the traffic flow stopping on the WAN side or the LAN side of the router. If it's the LAN side, further cut it in half by seeing if it's an issue on the router (not sending traffic to the server, or sending it with the wrong attributes) or the server (not sending traffic back, or sending it back wrong).
 
heviejob
Member Candidate
Member Candidate
Topic Author
Posts: 171
Joined: Mon Nov 30, 2009 4:54 pm

Re: Port Natting on RB750G suddenly stopped.

Sat Sep 25, 2010 10:21 pm

I finally managed to resolve the issue. I had to remove all the nat rules applying to affected ips and reconfigured them. I learnt something while at it. Thank you for the advice it worked.

Who is online

Users browsing this forum: No registered users and 36 guests