Community discussions

MikroTik App
 
cylent
Member
Member
Topic Author
Posts: 383
Joined: Sun May 28, 2006 10:30 am

basic port foward easily achieved by cheap routers. NOTonMT

Wed Feb 20, 2013 4:34 pm

I've been fighting with this issue for a few days now.

I have a server behind my RB1100 that has HotSpot/PPPoE.
All seems to be working just fine for the MTRouter which is great.

I just need to port forward port 8787 so when i type my external IP with port 8787 (1xx.224.27.xxx:8787) it sends me to my internal server so i can get to it.

I have created the following rule:

8 ;;; port forward
chain=dstnat action=dst-nat to-addresses=192.168.8.1 to-ports=8787
protocol=tcp port=8787

yes. the server is on a different subnet (192.168.8.0/29). It also is on a different port (5)... however all is well since MT can ping it just fine:

[admin@Mikrotik] > ping 192.168.8.1
HOST SIZE TTL TIME STATUS
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
sent=5 received=5 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms
 
User avatar
jp
Long time Member
Long time Member
Posts: 611
Joined: Wed Mar 02, 2005 5:06 am
Location: Maine
Contact:

Re: basic port foward easily achieved by cheap routers. NOTo

Wed Feb 20, 2013 7:38 pm

 
cylent
Member
Member
Topic Author
Posts: 383
Joined: Sun May 28, 2006 10:30 am

Re: basic port foward easily achieved by cheap routers. NOTo

Wed Feb 20, 2013 8:39 pm

I don't want to sound rude but that's not much help. I've already created that rule missing only the external ip as in the example 69.69.69.69
The problem here is how can a simple cheap routes be it tp_link or linksys do what's needed so easily while I can't do it in RouterOS
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: basic port foward easily achieved by cheap routers. NOTo

Wed Feb 20, 2013 9:15 pm

What does this mean?
I have a server behind my RB1100 that has HotSpot/PPPoE.
Is the server on an interface with a hotspot?

The server is assigned 192.168.8.1/29? What is the MikroTik router interface assigned on that localnet? The reason I ask is because I normally assign an address like 192.168.8.1 to my router interface, not devices behind it.
 
cylent
Member
Member
Topic Author
Posts: 383
Joined: Sun May 28, 2006 10:30 am

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 12:24 am

The server (192.168.8.1) is on an interface thats no where near the hotspot/pppoe on the mikrotik.

Ether1 is for net.
Ether5 is for the server (192.168.8.1)
ports 6-11 are bridged to make one port and thats what the hotspot/pppoe is on.
 
User avatar
jp
Long time Member
Long time Member
Posts: 611
Joined: Wed Mar 02, 2005 5:06 am
Location: Maine
Contact:

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 1:08 am

created that rule missing only the external ip as in the example 69.69.69.69
That could be why it's doesn't work.
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 1:28 am

You didn't answer my question. What ip is ether5 assigned? Are you certain the default gateway in the server is correct? It needs to be that ip.

If you want specific answers, you must provide specific information.
 
cylent
Member
Member
Topic Author
Posts: 383
Joined: Sun May 28, 2006 10:30 am

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 5:30 am

ether5 is 192.168.8.2/29

server is 192.168.8.1/29
 
kgninfos
Member
Member
Posts: 387
Joined: Thu Jun 21, 2012 7:34 pm
Location: Earth
Contact:

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 8:29 am

Use this
add action=dst-nat chain=dstnat dst-address=pubic_ip dst-port=8787 protocol=tcp to-addresses=192.168.8.1 to-ports=8787
if static public ip is assigned to ether1

or else
add action=dst-nat chain=dstnat in-interface=ether1 dst-port=8787 protocol=tcp to-addresses=192.168.8.1 to-ports=8787
if you have changed the replace ether1 with actual port name(Case sensitive)

give +1 karma if this helped you
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 2:03 pm

The server has 192.168.8.2 as the assigned gateway? Nothing in the firewalls (router or server) that could be blocking this?
 
rjickity
Member Candidate
Member Candidate
Posts: 212
Joined: Sat Jul 17, 2010 10:40 am
Location: Perth, Australia

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 2:55 pm

Supply the in-interface like advised above and it will work.

If it doesn't, show us /ip firewall filter export compact

Without more info you wont get much help
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: basic port foward easily achieved by cheap routers. NOTo

Thu Feb 21, 2013 4:17 pm

I just tested this on my router with an internal server at 192.168.1.254. It works fine without an in-interface or dst-address parameter.
/ip firewall nat
add chain=dstnat action=dst-nat dst-port=8088 to-addresses=192.168.1.254 to-ports=80 protocol=tcp
This accessed the internal server from the internet.
http://xx.xx.xx.xx:8088

edit: I also tried the same using port 80 on both, and I could access the server from the internet.
/ip firewall nat
add chain=dstnat action=dst-nat dst-port=80 to-addresses=192.168.1.254 to-ports=80 protocol=tcp
This accessed the internal server from the internet.
http://xx.xx.xx.xx

HOWEVER, this redirects all port 80 destination traffic to 192.168.1.254. The internet became unreachable from internal computers. In that case, an in-interface or dst-address would be necessary to work properly.

Who is online

Users browsing this forum: cage7557, engycz, nichky and 29 guests