Good day.

I am trying to port forward port 25565 to my internal IP address in order to be able to host a minecraft server for my friends via WAN. I have set up the nat rule /ip firewall nat add chain=dstnat protocol=tcp dst-address= <MY EXTERNAL IP> dst-port=25565 action=dst-nat to-address=<SERVER IP> to-ports=25565.

The server works locally but not via WAN. Interestingly the error message my friends receive is "Connection refused: no further information" as opposed to "Connection timed out".

When checking ports online via https://www.yougetsignal.com/tools/open-ports/, port 25565 displays as closed. But after reading some of the other forum posts pertaining to port forwarding for minecraft, some users suggested that dst-nat rules will show their ports as closed. In any case, so far I have been unsuccessful in solving this problem myself.

Any help would be appreciated!

Edit: Added my config file

FIRST ISSUE............ where are your firewall rules
Your router is not safe connected to the internet.
Please install these......

ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input in-interface-list=lan
add action=drop chain=input
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="Allow internet traffic outbound" in-interface-list=lan out-interface-list=WAN
add action=accept chain=forward comment="Allow Port Forwarding" connection-nat-state=dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=forward


(1) From current interface list members to........
/interface list member
add interface=PrivateBR list=lan
add interface=ether1 list=WAN
add interface=PPPOE-InternetConnection list=WAN

(2) This is garbage remove!!
add action=accept chain=forward dst-address=1xx.1xx.xx.1xx dst-port=25565 \
protocol=tcp

(3) Get rid of all RAW RULES, not required.
or at least DISABLE until we get the config working...........

(4) DISABLE IP Service telnet its not a safe protocol to use to access the router (plain text).

(5) Source nat rule incomplete modify to.
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN

(6) Required Destination NAT rule (which is now supported by the new firewall rules)
add action=dst-nat chain=dstnat dst-port=25565 protocol=tcp in-interface-list=WAN \
to-addresses=192.168.1.150

I note that you have put in what look like public IPs on your config which you should not if indeed public!! (the bad forward rule in (2) and your dstnat rule ??)

Is the WANIP you get actually fixed static, or dynamic (will change)??
If dynamic then you can use the rule I have above, if its static your dst nat rule is okay (just put in fake numbers if they are not already).

Hi, thanks for the quick response!

I've taken your suggested actions, the WANIP is not static.

After doing so, however my friends still cannot join, same error.

What is the logging saying?
If necessary, add logging to find out if your friend hits the firewall rule.

Have you tested if the port is open?
Are you 100% sure that there is something listening on port 25565?
Have you checked if the port is open from the Internet (with an online tool)?

Using a port checking tool shows the port still remains closed.

As far as listening on port 25565 goes, I assume the minecraft server fulfills that criterion?

I wouldn't know the first step towards logging the firewall rule.

No worries, this may take several iterations please post your latest export.

/export hide-sensitive file=anynameyouwish

Thanks so much, here is the latest config.

That public address of yours, does the router itself have exactly this address, or is it just what some online "show me my address" service showed you?

The latter, it's what shows up when I google "my ip".

And did ISP in any way indicate that you should have public address? Because if they didn't, it's very possible that you don't have any. And if you don't, there won't be any incoming connections for you. There will always be some public address involved, but if it's somewhere on their remote router, with no ports forwarded to you, you can't do anything with it.

If the router doesn't have it, it can still be NAT 1:1. If you look at your dstnat rule, does packet counter show anything? If yes, there are some incoming connections. If it's zero, you're probably out of luck. One more chance would be if the public address in on some modem you're connected to. Either you may have access to it, of ISP could enable NAT 1:1 if you ask for it.

There are packets showing, albeit only 5.

Besides Sobs befuddlement let me add my own.

Very confusing from my vantage point.
I dont understand what PPTP is doing either and why had configured it as the destination address for the minecraft server originally??
What is the purpose of PPTP here??

Why is this still an entry its meaningless
/interface list member
add list=WAN

Assuming ether1 is your wan connection through which the pppoe client comes in on.
what is the purpose of this .........
add exclude=dynamic name=list1
add interface=ether1 list=list1

I've just arrived at my parent's place after graduating, so I have no idea how this thing was set up.

No worries, best bet is to contact the service provider technical support and get them to walk you throught how their internet works and how their internet MODEM device interacts with the Mikrotik etc....... They wont know the MT specifics but will know what information they have to give you to put on the mikrotik.

If the current dstnat rule (with in-interface-list=WAN) sees any packets, it's good sign. The counter should increase every time you use the online port tester. You can also enable logging for the rule to see more details. If this is ok, then check target server, make sure its firewall doesn't block it, i.e. that it allows connections to the port from anywhere, not just from LAN.

@anav: Thank you for expanding my vocabulary, but I'm not sure if I'm entirely happy.

One small correction, if it's actually PPTP used to access internet, then pptp-out1 would need to be in WAN interface list too. Or you can replace in-interface-list=WAN in dstnat rule with dst-address-type=local.

Ahh well thats interesting in which case the proper thing to do would be too simply add
add interface=pptp-out1 list=WAN

It did not occur to that an ISP would require one to be both a PPPOE client and a PPTP client at the same time.

My ISP technically isn't supposed to have given me the password for the router, but I knew the guy who came out to check (small town) and he gave it to me. All I knew was that the ISP couldn't figure out how to accomplish anything when I logged tickets, so I thought I could sort it out. But I'm not too savvy with mikrotik devices, I'm way out of my depth. I tried
add interface=pptp-out1 list=WAN
But it doesn't seem to have changed the server or the port tester.

It seems as if the packets for the dst-nat rule do increase when I test the ports.

Add this and test it again:
If you see packets with prefix to-server logged, it means that dstnat works. Then you should see responses with from-server prefix going back to client's address.

How do I see where the packets are from?

In log, look for "Log" in left menu, it's in both WinBox (recommended) and WebFig. Or "/log print" in terminal.

My log only seems to print user logins, rule changes and the like.

Then keep playing with rules, for example this should log all incoming connections from internet:
Or you can add log=yes to dstnat rule, and you'll see what exactly makes the counter increase.

I can't seem to find out what's increasing the packets (they haven't increased from 49 in a while). I've tried testing the ports with different online tools, I've tried connecting locally to the minecraft server, and tried stopping and restarting the server.

Again, you'll see it if you enable logging for the rule. If you do it from GUI, open existing rule and check Log on Action tab. And the thing that should trigger it is when someone connects to that port. Online port scanners included, so every time you test it, counter should increase and a line in log should appear. There you can see source address.

Server itself is important too, but the first step is to make sure that there are incoming connection from internet to your router at all. You'll get nowhere without that.

I had already enabled logging when rechecking all the aforementioned things.

1) how do you specify the server address and port in minecraft, when connecting? can you post a screenshot?
2) does the machine running the minecreaft server allow incoming connections? maybe there is another antivirus or firewall that is working

Use this to test your port config.
https://canyouseeme.org/

Add your MC port and click check. If all is ok, you should get a green success.

The external IP address given by canyouseeme is not the same as when I google "my ip". The IP's are identical except for the last number which is 9 instead of 8.

@normis
The server runs on my machine (192.168.1.150), minecraft's default server port is 25565. Servers address is specified when saving a server (or whenever connecting).
The aforementioned machine is running only windows defender and java has been allowed through the windows defender firewall. As far as I know the machine should allow incoming connections, but I will try connect to the server with another machine on the network.
Edit: The other machine on the network can connect (via LANIP not WANIP).

One note here is the config file show a pretty old version. Now an upgrade is NOT likely going fix the actually issue here with firewall et'al.

The external IP address given by canyouseeme is not the same as when I google "my ip". The IP's are identical except for the last number which is 9 instead of 8.

Then you have a problem. It may seems that you have several public IP?
Try some other locator:
https://www.whatismyip.com/
http://minip.no/
https://www.ipfingerprints.com/
https://tools.keycdn.com/geo

All should give only one IPv4 IP

what does your IP cloud IP address show??? when comparing to the other methods.......

what does your IP cloud IP address show??? when comparing to the other methods.......

...to enable to that use: (or in Winbox/Webfig under "IP" then "Cloud", there is a checkbox for "Enable DDNS", both will show a public address the Mikrotik's servers calculate. Might be useful since you can use DNS name in IP>Cloud, instead giving the current public IP address to your friends to use to connect to the server – if your public IP address changes, IP>Cloud will automatically the name to use the new IP address.

@Jotne
All of the above websites have my public IP as xxx.xxx.x.xx9, whereas googling "my ip" displays it as xxx.xxx.x.xx8 (the x's being identical).
@anav
My cloud IP address is the one above ending in 8.

Strangely the IP location finder websites all list my location as on the other side of the country. I am not using a VPN.

Since some routes give 8 and other 9, for sure some will fail.
I would have talked to my ISP and asked why this happens.

Managed to get the server working using Radmin VPN. Thank you all for all your help, you guys were super useful! Happy holidays and have a great New Year!

Since some routes give 8 and other 9, for sure some will fail.
I would have talked to my ISP and asked why this happens.

Yup, but his ISP already just give him the admin password to try to fix a router they provided - tells you something

I do think ZeroTier will be great for this kind of thing in future. Too old for Minecraft, but do know running a server for a group of friends is a common thing... Each player join a ZeroTier network with one server - Minecraft sever binds to ZeroTier address. No forwarding required, no public IPs, network matches the virtual world.