Community discussions

MikroTik App
 
djboxny
just joined
Topic Author
Posts: 19
Joined: Mon Sep 05, 2011 7:15 am

Port Forwarding working only on first Nat rule

Fri Nov 18, 2011 9:23 am

I have a RB 435g, installed with 5.7 router os, the issue i am having is that i am trying to do port forwarding because i am using it as a home router and onlye the first forwarding rule that i create in the NAT tab works, If i create a second rule it wont work. If i move the second rule to first place it works fine. This is very confusing to me

I have

[admin@MikroTik] > interface print
Flags: D - dynamic, X - disabled, R - running, S - slave
# NAME TYPE MTU L2MTU
0 R WAN ether 1500 1524
1 R LAN ether 1500 1524
2 X ether3 ether 1500 1524
3 X wlan1 wlan 1500
 
User avatar
TealFrog
just joined
Posts: 23
Joined: Sun Oct 02, 2011 11:56 am

Re: Port Forwarding working only on first Nat rule

Fri Nov 18, 2011 10:35 am

I have to admit I am somewhat new to Tik routers myself; however, I suspect that at a minimum more information will be needed. If I had to take an educated guess, there is something matching the first rule that isn't allowing the next rule to be processed. If you can issue the following commands on the router, copy and paste the results here, then it may help to determine the nature of the issue.
/ip address print detail without-paging
/ip firewall nat print detail without-paging 
More information may be needed depending on the results.

Regards.
TealFrog
 
Feklar
Forum Guru
Forum Guru
Posts: 1726
Joined: Tue Dec 01, 2009 11:46 pm

Re: Port Forwarding working only on first Nat rule

Fri Nov 18, 2011 4:38 pm

Chances are your rules are too general, so they catch everything, instead of just what you are looking for. So order is important, and how specific or general your rules are is also very important.
 
djboxny
just joined
Topic Author
Posts: 19
Joined: Mon Sep 05, 2011 7:15 am

Re: Port Forwarding working only on first Nat rule

Sat Nov 19, 2011 3:08 am

xxx is my WAN ip

[admin@MikroTik] > ip address print detail without-paging
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; added by setup
address=192.168.1.1/24 network=192.168.1.0 interface=LAN
actual-interface=LAN

1 ;;; added by setup
address=xxx.xxx.xxx.116/24 network=xxx.xxx.xxx.xxx interface=WAN
actual-interface=WAN

wan interface is a static ip provided by my isp. that is working fine



[admin@MikroTik] > / ip firewall nat print detail without-paging
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=WAN

1 ;;; Avermedia 1
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=5550
protocol=tcp dst-address=173.220.110.xxx

2 ;;; Avermedia 2
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=5550
protocol=udp dst-address=xxx.xxx.xxx.xxx

3 ;;; Air Video 1
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=45631
protocol=tcp dst-address=xxx.xxx.xxx.xxx

4 ;;; Air Video 2
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=45631
protocol=udp dst-address=xxx.xxx.xxx.xxx
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Port Forwarding working only on first Nat rule

Sat Nov 19, 2011 3:35 am

xxx is my WAN ip

[admin@MikroTik] > ip address print detail without-paging
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; added by setup
address=192.168.1.1/24 network=192.168.1.0 interface=LAN
actual-interface=LAN

1 ;;; added by setup
address=xxx.xxx.xxx.116/24 network=xxx.xxx.xxx.xxx interface=WAN
actual-interface=WAN

wan interface is a static ip provided by my isp. that is working fine



[admin@MikroTik] > / ip firewall nat print detail without-paging
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=WAN

1 ;;; Avermedia 1
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=5550
protocol=tcp dst-address=173.220.110.xxx

2 ;;; Avermedia 2
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=5550
protocol=udp dst-address=xxx.xxx.xxx.xxx

3 ;;; Air Video 1
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=45631
protocol=tcp dst-address=xxx.xxx.xxx.xxx

4 ;;; Air Video 2
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=45631
protocol=udp dst-address=xxx.xxx.xxx.xxx
Everyone else was spot on - your rules are FAR too broad.
chain=dstnat action=dst-nat to-addresses=192.168.1.135 to-ports=5550 
     protocol=tcp dst-address=173.220.110.xxx 
That means, translated to English, "forward all TCP traffic destined to 173.220.110.x to 192.168.1.135 on port 5550". Note here that you told the the router to forward ALL TCP traffic to that port, regardless of what port it was originally to. You want to add dst-port=5550 to that - presumably, anyway. Traffic never reaches the second TCP rule because all TCP traffic already matched the previous rule that matched all TCP traffic. Change the other rules accordingly. The router will do exactly what you tell it to, so if you only want to forward traffic to a specific port and IP to a different IP port you need to specify all parts of that.
Specific answers require specific questions. When in doubt, post the output of "/ip address print detail", "/ip route print detail", "/interface print detail", "/ip firewall export", and an accurate network diagram.
 
djboxny
just joined
Topic Author
Posts: 19
Joined: Mon Sep 05, 2011 7:15 am

Re: Port Forwarding working only on first Nat rule

Sat Nov 19, 2011 3:42 am

So where i put my destination wan ip, also put the port? On the nat - General tab?
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Port Forwarding working only on first Nat rule

Sat Nov 19, 2011 4:12 am

Not sure, I don't have winbox available. It should say "destination port" somewhere near where you pick TCP as a protocol, going by memory.
Specific answers require specific questions. When in doubt, post the output of "/ip address print detail", "/ip route print detail", "/interface print detail", "/ip firewall export", and an accurate network diagram.
 
djboxny
just joined
Topic Author
Posts: 19
Joined: Mon Sep 05, 2011 7:15 am

Re: Port Forwarding working only on first Nat rule

Sat Nov 19, 2011 5:10 am

That worked perfectly, thanks guys

Who is online

Users browsing this forum: hamster922, jell2020, mikruser, miro79 and 78 guests