I have searched many times, read many posts, read and re-read the wiki page, but I unable to get Hairpin NAT working with a dynamic public IP.
This is for a RB2011 with default settings. I disabled the dhcp-client on ether1-gateway and statically assign the IP so it is easier to change during testing.
ether1-gateway: 10.1.1.1/24 (Once testing is complete this will be a real public IP)
Server: 192.168.88.254 with MySQL configured and working.
[admin@MikroTik] /ip firewall nat> pri Flags: X - disabled, I - invalid, D - dynamic 0 ;;; default configuration chain=srcnat action=masquerade out-interface=sfp1-gateway 1 ;;; default configuration chain=srcnat action=masquerade to-addresses=0.0.0.0 out-interface=ether1-gateway 2 ;;; Public MySQL (by interface) chain=dstnat action=dst-nat to-addresses=192.168.88.254 protocol=tcp in-interface=ether1-gateway dst-port=3306 3 X ;;; Public MySQL (by IP) chain=dstnat action=dst-nat to-addresses=192.168.88.254 protocol=tcp dst-address=10.1.1.1 dst-port=3306 4 ;;; Hairpin NAT MySQL chain=srcnat action=masquerade protocol=tcp src-address=192.168.88.0/24 dst-address=192.168.88.254 out-interface=bridge-local dst-port=3306With rule 2 active I am unable to connect from 192.168.88.48->10.1.1.1 and have it redirect (hairpin NAT) to 192.168.88.254. It I disable rule 2 and enable rule 3, then hairpin NAT works. The problem with rule 3 is it does not work if the IP on ether1-gateway changes.
Can someone point out my problem? I am stuck.