Community discussions

MikroTik App
 
PrimeYeti
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 65
Joined: Wed Mar 01, 2023 1:46 pm

Rookie Question: DstNAT

Wed Aug 09, 2023 6:32 pm

If I put the below rule in my NAT table to DstNAT port 1234 from my public address to my local address:

Chain Dstnat
Dst address: 1.1.1.1
Dst port: 1234
Action Dstnat
Dst address: 192.168.1.1

Is that just going to forward to internal port 1234 since the external port is 1234, even though I haven't specified the internal port in the rule?

Not attempting to achieve anything just genuinely curious. :)
 
User avatar
anav
Forum Guru
Forum Guru
Posts: 21360
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada
Contact:

Re: Rookie Question: DstNAT

Wed Aug 09, 2023 9:44 pm

Format for dstnat rules is normally dependent upon the type of WAN connection.

1. You need a generic firewall rule to allow port forwarding.
This is the crappy but safe default rule one gets in the forward chain.
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN


This is the way to replace it with more clarity and overall better security:
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"


2. For a Dynamic WAN situation typically the format is as follows ( lets say ISP blocks port YYYY )
add chain=dst-nat action=dst-nat dst-port=XXXXX protocol=abc in-interface=WAN1 to-address=deviceIP to-ports=YYYYY

Note1: To-Ports is only required if doing port translation (aka the incoming port hitting the WAN has to be different from when it hits the device).

3. For a Static WANIP, the format is as follows ( no blocking on this ISP):
add chain=dst-nat action=dst-nat dst-port=YYYYY protocol=abc dst-address=WANIP to-address=deviceIP

Note2: From a security perspective, limiting access to a source address or source address list should be done. Users of your servers should either have a static IP, OR if dynamic they can get a FREE dyndns type name that the MT will resolve to WANIP in a source address list. Adding a source part to the dstnat rule also makes the port invisible on scans. Without such a condition, the port will appear on scans as closed.

4. When you have users accessing servers locally it gets complicated if you insist on them using the WANIP vice the direct LANIP of the server. If you must, then reading here will guide you.
viewtopic.php?t=179343
Last edited by anav on Thu Aug 10, 2023 1:34 pm, edited 1 time in total.
 
PrimeYeti
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 65
Joined: Wed Mar 01, 2023 1:46 pm

Re: Rookie Question: DstNAT

Thu Aug 10, 2023 12:44 pm

Note: To-Ports is only required if doing port translation (aka the incoming port hitting the WAN has to be different from when it hits the device).
So if To-ports is left blank, the port on the local side doesn't change right? So if the Dst Port was 1234 and the To Port was blank, that traffic would just go to 1234.
 
User avatar
karlisi
Member
Member
Posts: 464
Joined: Mon May 31, 2004 8:09 am
Location: Latvia

Re: Rookie Question: DstNAT

Thu Aug 10, 2023 12:57 pm

Yes

Who is online

Users browsing this forum: Bing [Bot], zeynelyenici and 33 guests