I need to do port forwarding on Mikrotik 2.9
I need to forward ports 80 and 3389 to the inside network.
I have one public IP address and the following NAT rules on this router
----------------------------------------------
[admin@X] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=OUT src-address=10.0.0.0/8 action=masquerade
1 chain=srcnat out-interface=OUT src-address=172.16.0.0/16 action=masquerade
----------------------------------------------
Re: Port Forwarding
You can find it here:
http://www.mikrotik.com/docs/ros/2.9/ip/nat
http://www.mikrotik.com/docs/ros/2.9/ip/nat
Code: Select all
chain=dstnat dst-address=[your public IP] protocol=tcp dst-port=80
action=dst-nat to-addresses=[your loal IP] to-ports=80
:(
It isn't working. PUBLIC_IP is the IP address of outside interface
[admin@X] ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ADSL src-address=10.0.0.0/8 action=masquerade
1 chain=srcnat out-interface=ADSL src-address=172.16.0.0/16 action=masquerade
2 chain=dstnat dst-address=PUBLIC_IP protocol=tcp dst-port=3389 action=dst-nat to-addresses=10.10.10.3 to-ports=3389
[admin@X] ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ADSL src-address=10.0.0.0/8 action=masquerade
1 chain=srcnat out-interface=ADSL src-address=172.16.0.0/16 action=masquerade
2 chain=dstnat dst-address=PUBLIC_IP protocol=tcp dst-port=3389 action=dst-nat to-addresses=10.10.10.3 to-ports=3389
WITHOUT dst-address=PUBLIC_IP_OF_THE_ROUTER everything works just fine
WHYYYYY
[admin@X] ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ADSL src-address=10.0.0.0/8 action=masquerade
1 chain=srcnat out-interface=ADSL src-address=172.16.0.0/16
action=masquerade
2 chain=dstnat protocol=tcp dst-port=3389 action=dst-nat
to-addresses=10.10.10.3 to-ports=3389
[admin@X] ip firewall nat>
WHYYYYY
[admin@X] ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat out-interface=ADSL src-address=10.0.0.0/8 action=masquerade
1 chain=srcnat out-interface=ADSL src-address=172.16.0.0/16
action=masquerade
2 chain=dstnat protocol=tcp dst-port=3389 action=dst-nat
to-addresses=10.10.10.3 to-ports=3389
[admin@X] ip firewall nat>
Problem description
When I make port forwarding let say on port 27015 all traffic is forwarded to this IP not just that to port 27015. Can you tell me why
Sometimes when I add rule like this:
ip firewall nat add chain=dstnat protocol=tcp dst-port=23 action=dst-nat to-addresses=10.10.10.203 to-ports=23
everything stops working. All traffic is forwarded to 10.10.10.203 in this example. When I make trace i se traffic going to my gate where I make NAT and port forwarding and then going back to 10.10.10.203
But sometimes everything is working ??????
I have this topology
10.10.10.0 NETWORK -- RouterA --- RouterB --- RouterC --- RouterD(NAT)
RouterD have only one public IP
ip firewall nat add chain=dstnat protocol=tcp dst-port=23 action=dst-nat to-addresses=10.10.10.203 to-ports=23
everything stops working. All traffic is forwarded to 10.10.10.203 in this example. When I make trace i se traffic going to my gate where I make NAT and port forwarding and then going back to 10.10.10.203
But sometimes everything is working ??????
I have this topology
10.10.10.0 NETWORK -- RouterA --- RouterB --- RouterC --- RouterD(NAT)
RouterD have only one public IP
You wrote: "when I put dst-address=public_ip which is IP address of Mikrotik outside interface and it isn't working"
What does it exactly mean "it isn't working"?
Packets do not arrive to your public interface?
Packets arrive to public interface and Mikrotik handles them incorrectly?
Packets arrive to public interface, Mikrotik handles them correctly and there is other error?
This is why I asked you to log packets in case when it is "not working"....
What does it exactly mean "it isn't working"?
Packets do not arrive to your public interface?
Packets arrive to public interface and Mikrotik handles them incorrectly?
Packets arrive to public interface, Mikrotik handles them correctly and there is other error?
This is why I asked you to log packets in case when it is "not working"....