Port forwarding issues

camg · Sun Feb 12, 2023 3:47 pm

Hello, I have a port forwarding question for you. After setting up port forwarding, the scan port is not open, here is the configuration. What is the problem?

[admin@mikrotik] > export 
# feb/12/2023 13:43:24 by RouterOS 7.7
# software id = TI09-7WK3
#
/interface ethernet
set [ find default-name=ether1 ] disable-running-check=no name=Exsi-Lan
set [ find default-name=ether2 ] disable-running-check=no name=PCIE-Lan1
set [ find default-name=ether2 ] disable-running-check=no name=PCIE-Lan2
set [ find default-name=ether3 ] disable-running-check=no name=R730xd-LAN
set [ find default-name=ether4 ] comment=DX disable-running-check=no name=WAN-DX
set [ find default-name=ether5 ] comment=LT disable-running-check=no name=WAN-LT
/interface pppoe-client
add add-default-route=yes comment=ISP-LT disabled=no interface=WAN-LT name=pppoe-out1 user=xxxxxxx
add add-default-route=yes comment=ISP-DX disabled=no interface=WAN-DX name=pppoe-out2 user=xxxzzz
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=223.255.255.2-223.255.255.254
add name=dhcp_pool1 ranges=223.255.255.2-223.255.255.254
/ip dhcp-server
add address-pool=dhcp_pool1 interface=R730xd-LAN name=dhcp1
/port
set 0 name=serial0
set 1 name=serial1
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface ovpn-server server
set auth=sha1,md5
/ip address
add address=223.255.255.1/24 interface=R730xd-LAN network=223.255.255.0
/ip dhcp-server network
add address=223.255.255.0/24 gateway=223.255.255.1
/ip dns
set allow-remote-requests=yes servers=223.5.5.5
/ip firewall filter
add action=accept chain=input comment="22\B6\CB\BF\DA\B7\C5\D0\D0" dst-port=22 in-interface=pppoe-out1 protocol=tcp
add action=accept chain=input comment="22\B6\CB\BF\DA\B7\C5\D0\D0" dst-port=22 in-interface=pppoe-out2 protocol=tcp
add action=accept chain=input comment="8291\B6\CB\BF\DA\B7\C5\D0\D0" dst-port=8291 in-interface=pppoe-out1 protocol=tcp
add action=accept chain=input comment="8291\B6\CB\BF\DA\B7\C5\D0\D0" dst-port=8291 in-interface=pppoe-out2 protocol=tcp
add action=accept chain=input comment="100\B6\CB\BF\DA\B7\C5\D0\D0" dst-port=100 in-interface=pppoe-out1 protocol=tcp
add action=accept chain=input comment="100\B6\CB\BF\DA\B7\C5\D0\D0" dst-port=100 in-interface=pppoe-out2 protocol=tcp
add action=drop chain=input comment="drop\CD\E2\CD\F8\B7\C3\CE\CA\C2\B7\D3\C9\C6\F7" in-interface=pppoe-out1
add action=drop chain=input comment="drop\CD\E2\CD\F8\B7\C3\CE\CA\C2\B7\D3\C9\C6\F7" in-interface=pppoe-out2
/ip firewall nat
add action=masquerade chain=srcnat out-interface=pppoe-out1 src-address=223.255.255.0/24
add action=masquerade chain=srcnat out-interface=pppoe-out2 src-address=223.255.255.0/24
add action=dst-nat chain=dstnat dst-port=100 in-interface=pppoe-out1 protocol=tcp to-addresses=223.255.255.0/24 to-ports=100
add action=dst-nat chain=dstnat dst-port=100 in-interface=pppoe-out2 protocol=tcp to-addresses=223.255.255.0/24 to-ports=100
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system hardware
set allow-x86-64=yes
/system identity
set name=mikrotik
[code]

camg · Sun Feb 12, 2023 3:49 pm

After setting up port 100 mapping, the scan port prompt is unsuccessful

anav · Sun Feb 12, 2023 4:10 pm

Is this an internet facing router? If so the router should be removed, netinstalled with new fresh copy of firmware and next time
keep the default firewall rules and DONT open up ports in the input chain for port forwarding.
That is done in the NAT rules section.
Further, you dont manage the router directly via the input chain or PORT forwarding, big no no/

Use wireguard vpn to access the router for configuration purposes.

Sob · Sun Feb 12, 2023 5:29 pm

And regarding the actual port forwarding, you can't forward it to 256 addresses at once, you need to-addresses=<single address>.

camg · Mon Feb 13, 2023 10:06 am

And regarding the actual port forwarding, you can't forward it to 256 addresses at once, you need to-addresses=<single address>.

Thank you for the reminder, I have revised it. I currently have a question is whether multiple wan ports can be port forwarding, I tested a wan port set port forwarding is working, but to two wan port does not work

Sob · Mon Feb 13, 2023 11:00 am

The problem with multi WAN is that you need to send responses back the same way the requests came from, but it doesn't happen automatically. You'll need new routing tables (one for each WAN), mark connections based on incoming interface, and then mark routing for responses. See e.g. this example: https://wiki.mikrotik.com/wiki/Manual:P ... _Balancing. It's mainly about load balancing, so ignore that part (rules with per-connection-classifier connection) and focus on the rest. In v7 you also have to define routing table first (in /routing/table).

camg · Wed Feb 15, 2023 6:51 pm

Thanks for your answer, I think how I should set it up

Port forwarding issues

Port forwarding issues

Re: Port forwarding issues

Re: Port forwarding issues

Re: Port forwarding issues

Re: Port forwarding issues

Re: Port forwarding issues

Re: Port forwarding issues

Who is online