Port forward not working

LaPeppona · Sun Sep 04, 2022 10:48 am

It goes, but to wrong ISP, since you are not marking incoming (from ISP) connections.

what can you do in your case:

1) Do not override "new-connection-mark", add to every mangle rule "connection-mark=no-mark" every time you do "new-connection-mark"
It gonna look like this:

/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL

It will not mark connection again, if it's already got one.

2) Mark new connections, that comes from ISP sides:

add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no

to the end of current

/ip firewall mangle

where ether2 and Telekom are corresponding ISP interfaces on your router

so at the end mangle section gonna look like this:

/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=yes src-address-list=LAN
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=prerouting dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no

LaPeppona · Sun Sep 04, 2022 5:43 pm

Code: Select all
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=yes src-address-list=DUAL
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=yes
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
Thanks for your reply, it solved the problem!

However i wonder why did you left 2 rules with passthrough yes and 2 without passthrough? Is there a reason for it? I've tested it with passthrough yes on all rules and it looks like it doesn't affect the port forward.

Ye, sorry, I was too lazy to read whole thing, and typed it early morning.

Yes you dont need passthrough=yes on last 4 rules (it can be passthrough=no). I just typed about it to be sure, to avoid possible mistake.

I fixed the original post

u also dont need passthrough=yes in "Mark connections for hairpin NAT" I think. Since u are not using that mark in further mangle table.

LaPeppona · Sun Sep 04, 2022 8:58 pm

Ye, sorry, I was too lazy to read whole thing, and typed it early morning.

Yes you dont need passthrough=yes on last 4 rules (it can be passthrough=no). I just typed about it to be sure, to avoid possible mistake.

I fixed the original post

u also dont need passthrough=yes in "Mark connections for hairpin NAT" I think. Since u are not using that mark in further mangle table.
I did some testing and with everything passthrough=yes and it somehow managed to pull 10% more cpu usage and 200mbps more upload speed which saturated the 1Gb link.

"passthrough=no" jumps out from mangle table if rule passed, so with passthrough=no it checks less rules in some scenarios.
If u realy want more optimizations, you can use accept and jump actions
where you can put all connection markings in additional Chain and jump there with no-mark check.

maybe something like this, I have not tested it:

/ip firewall mangle
add action=mark-connection chain=newmark comment=\
    "Mark connections for hairpin NAT" dst-address-list=WAN \
    connection-mark=no-mark new-connection-mark="Hairpin NAT" passthrough=no src-address-list=LAN
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=ether2 new-connection-mark=con-one passthrough=no
add action=mark-connection chain=newmark connection-mark=no-mark in-interface=Telekom new-connection-mark=con-two passthrough=no
add action=mark-connection chain=newmark dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-one passthrough=yes per-connection-classifier=\
    src-address-and-port:2/0 src-address-list=DUAL
add action=mark-connection chain=newmark dst-address-type=!local \
    connection-mark=no-mark new-connection-mark=con-two passthrough=yes per-connection-classifier=\
    src-address-and-port:2/1 src-address-list=DUAL
add action=mark-connection chain=newmark connection-mark=no-mark new-connection-mark=default passthrough=no comment="default mark"

add action=jump chain=prerouting connection-mark=no-mark jump-target=newmark
add action=mark-routing chain=prerouting connection-mark=con-one \
    new-routing-mark=Antik passthrough=no src-address-list=DUAL
add action=mark-routing chain=prerouting connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no src-address-list=DUAL

LaPeppona · Wed Sep 07, 2022 7:58 pm

coz Prerouting chain serves only "incoming" packets, to make router to answer to his own connections via correct routing tables u have to also to mark-routing to router own packets using OUTPUT chain
Something like this:

/ip firewall mangle
add action=mark-routing chain=output connection-mark=con-one \
    new-routing-mark=Antik passthrough=no
add action=mark-routing chain=output connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no

plus it must have 2 default gates (0.0.0.0/0) in main table, for both ISPs. I am not sure btw if realy need them, I just have them to make :ping tool working (by choosing output interface later). But it may throu an error (No Route to House) without it.
(you already have them)

dont forget to use SAFE-MODE when adding/removing anything in INPUT/OUTPUT or POSTROUTING chains.

LaPeppona · Sun Sep 11, 2022 12:26 am

coz Prerouting chain serves only "incoming" packets, to make router to answer to his own connections via correct routing tables u have to also to mark-routing to router own packets using OUTPUT chain
Something like this:
Code: Select all
/ip firewall mangle
add action=mark-routing chain=output connection-mark=con-one \
    new-routing-mark=Antik passthrough=no
add action=mark-routing chain=output connection-mark=con-two \
    new-routing-mark=Telekom passthrough=no
plus it must have 2 default gates (0.0.0.0/0) in main table, for both ISPs. I am not sure btw if realy need them, I just have them to make :ping tool working (by choosing output interface later). But it may throu an error (No Route to House) without it.
(you already have them)

dont forget to use SAFE-MODE when adding/removing anything in INPUT/OUTPUT or POSTROUTING chains.
I added your rules, moved them around (now they are first) as well and they get 0 traffic and no route with ping as well no internet from router itself

two routes with 0.0.0.0/0 in main table still enabled? U said u disable them, I told you it must be enabled, to avoid "no route to host"

add check-gateway=ping comment=main disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.56.60.1 pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add check-gateway=bfd comment=main disabled=no distance=1 dst-address=0.0.0.0/0 gateway=Telekom pref-src=0.0.0.0 \
    routing-table=main scope=30 suppress-hw-offload=no target-scope=10

these
just double checking first

also when using :ping tool, specify interface

LaPeppona · Sun Sep 11, 2022 5:29 pm

thats strange. OUTPUT used only for local/own router traffic. And these 2 routes in main table should not affect anything for Forwarding traffic >.>
Idk try to disable these routes in main table, and use dynamic one, that provided by DHCP and PPPOE configs

If i turn on passthrough on your rules i get about 1gbps down and 100mbps up

on which rules

Show me whole /ip/firewall/mangle/ print u have right now

LaPeppona · Fri Sep 16, 2022 1:39 am

Hmmm, I dont see anything strange so far, only last 4 rules must be passthrou on no. and some rules in newmark chain must be passthrou on no too (first 3) and last one, coz they dont need anything after has been action applied.

But I noticed, that I dont have gateway check on my own dual-wan router configuration, coz they are kinda useless for me:
the check-gateway option in route.

also in Filter:
plus

add action=accept chain=output src-address-list=LAN

in Filter looks kinda useless for me, u dont need accept for this, its accepted by default, since u dont have any drop rule in output.

And I noticed u are using Fasttrack, u can also try to temporary disable it, and check out how it works without it (after restart)
here:

add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes

disable it and restart router.

LaPeppona · Sun Oct 16, 2022 2:02 am

Sorry i forgot to turn those routes on but without those rules

Sorry I also completely forgot, that you router may not be able to correctly init outcome connections to default route with both routes on. Only answering back, or serve specific routes with 1 gateway/w multiple distance, To correctly init outcome connections, you must use only one default route, or add rules to output chain / mangle table, that gonna premark connections (if connection has no mark), according to src address (these rules must be before mark-routing rules). I think its more ez just to use one active default route (0.0.0.0) // routes with different distance in main table, in ur case.
I got these rules hidden, so forgot about it.

(yesterday I was doing the whole routine of configuring "balancing" on new mikrotik router, and accidentally noticed that I forgot to write about this here, when was remaking the rules)

UPD: its probably not a big deal for TCP, when NAT/masquerade is ON, but it may cause problems with UDP.

Port forward not working [SOLVED]

Re: Port forward not working [SOLVED]

Re: Port forward not working

Re: Port forward not working

Re: Port forward not working

Re: Port forward not working

Re: Port forward not working

Re: Port forward not working

Re: Port forward not working

Who is online