Hi,

My ISP has provided me a private IP for my WAN connection (i.e. IP : 192.168.9.46/27, Gateway : 192.168.9.33/27). I know there is a procedure to connect to Winbox remotely if the WAN is configured with Public IP (IP > Firewall > Filter Rules > Add > Input Chain > Protocol TCP > Dst. Port 8291 > Action > Accept). But I am not using any Public IP in my WAN as I mentioned before.

So, I was wondering, is there any way I can access my router remotely (when I am not in my LAN) via internet ? Winbox or WebFig is OK for me.


Thank You.

Public IP address is mandatory for this. Alternatively, you can solicit to your ISP, a port forwarding from a public IP of ISP, to yout private IP.

You need to ask ISP for real internet connection, not just connection to their LAN. Real internet connection = public address. That might sound unhelpful, but it's how it goes, if you want ability to connect directly to your router from internet, you need public address. Or at least forwarded port from one, that's what ISP could possibly do for you, if they don't have enough public addresses. Other option could be if you had public address somewhere else, then you could establish VPN connection from your router to server with public address and forward some ports from there.

Thank You pietroscherer & Sob for your reply....

Any suggestion how I can use the port forwarding method to connect to my router remotely ?


Thanks in Adv.

I think both pietroscherer & Sob mentioned that you have to get into contact with your ISP. They are managing a device that is doing NAT for you.

To get some insights...can you post a tracert www.mikrotik.com? That would be very helpful!

Or you can dial the tunnel to outside somewhere where you are able to run a device with public ip.

or use ipv6. ask for it.

With my current settings (LAN & WAN both are in Private IP), can I use VPN to access my router remotely anyhow ?

Arnab,

Your ISP hides your router from public access with it's router/firewall. There is no way to easy access it without help of ISP.
If it would be possible then anyone could access any device behind ISP's router.

You can access your device only if your ISP remap any of public accessible ports of it's router to your router.
Then you can connect to your router with combination ISP_PUBLIC_IP:REMAPPED_PORT_TO_YOUR_ROUTER
You can establish VPN to your router only if you have direct access to your router's VPN ports which means that ISP needs again to remap it's ports to your router. What if someone else wants also to access own router ? Do you see the problem ?

You definitely need public IP.

Yeh... pretty much clear... thanks a lot for your reply

Of course the above is completely incorrect, you can always setup a VPN and access the router remotely via that.
You will need some external server to make the VPN to and that allows some port forwarding into your router.
Maybe someone offers that service, I have not researched that as I have public IP on IPv4 and IPv6 myself,
but I would not be surprised as this is available now more and more internet connections will be behind NAT on IPv4.

Of course the above is completely incorrect,...

Completly incorrect ? Really ?
You suggest setting up some VPN from private router to some external VPN server which offers users service of forwarding some particular external ports to particular VPN tunnel .... please show the example. Just one. Do you think that it is easy way ? Easier than PUBLIC IP ? Even if we agree on your propostion then it means that such VPN ISP just remaps external ports to internal interfaces despite what the interface is. So we are at the begining: ISP has to remap external IP:PORT to internal one.
I do not say that you are "completely incorrect" with your proposal but you suggest to take a sledgehammer to crack a nut. However you still need nut-cracker to operate sledgehammer to crack in.

Of course the above is completely incorrect,...

Completly incorrect ? Really ?
You suggest setting up some VPN from private router to some external VPN server which offers users service of forwarding some particular external ports to particular VPN tunnel .... please show the example. Just one.

You can setup any outgoing VPN to an external host that allows incoming traffic.
You can install that host yourself when you cannot find someone who already does that (I would be surprised if that were true...)
When you cannot find it, just install a CHR in some virtual hosting service and use it as your VPN server.

Do you think that it is easy way ?

No, but that was not what you claimed. You said: There is no way to easy access it without help of ISP.
That is simply not true, you can get the help of other parties than the ISP, e.g. Amazon EC2.
It is not easy to setup but then it is easy to access it. So "there is no way" that is completely incorrect.

Easier than PUBLIC IP ?

Yes, because PUBLIC IP is probably IMPOSSIBLE for him! At least for IPv4. He is at a provider that hands
RFC1918 addresses to their clients, and believe me, those providers don't do that for the fun of it.

Even if we agree on your propostion then it means that such VPN ISP just remaps external ports to internal interfaces despite what the interface is. So we are at the begining: ISP has to remap external IP:PORT to internal one.

I don't know what you are trying to claim here, but for sure: a VPN can be run over such NATted connections,
when you select the proper type of VPN, without any cooperation from the ISP.

I do not say that you are "completely incorrect" with your proposal but you suggest to take a sledgehammer to crack a nut. However you still need nut-cracker to operate sledgehammer to crack in.

The question was "How to Access Mikrotik Router Configured with Private IP Address in WAN via Internet".
The answer is: by setting up some VPN to traverse that NAT hop that only allows outbound traffic.
Your answer is: it is impossible.
I don't agree.

Pe1chl: "completly incorrect" is quite non disputable statement.

My answer is:

There is no way to EASY access it without help of ISP.

I have not written: it is not possible. Haven't you spotted part of VPN tunnel ?

Once more:
Seems that Arnab has not enough knowledge/experience to prepare VPN tunnel as solution for him so he IMHO asks for quite easy solution.

I don't know what you are trying to claim here, but for sure: a VPN can be run over such NATted connections,
when you select the proper type of VPN, without any cooperation from the ISP.

I thought that it is obvious for readers.
If not Arnab's ISP should expose somehow Arnab's router WAN interface to the public then any other ISP which terminates (is the OTHER END of) Arnab's established VPN tunnel end is expected to expose somehow this VPN end to the public. How ? Assigning him public address or letting establish other VPN tunnel to VPN server, which tunnel is bridged with the previous one. Despite all the internals of this process: there is ISP ... Arnab's ISP or any other one .... help needed to allow pass traffic from public to private interfaces of it's (it's = ISP's) router.
To be precise ... it is possible only if Arnab could establish VPN to any VPN server from his home router. Are you completly sure that it is possible ?

Pe1chl ... I do not know what are you trying to persude me to ?
I could have written that Arnab could install VPN server as virtual machine in his computer, establish DynamicDNS assigment for his PC and prepare home router to continously call his DDNS address to establish secured line to his computer. It is quite obvious easy solution.
But I do not think that such solution is the one he is asking for.

Pe1chl .. make routing not war

I am not the one making war, that is you and someone who negatively rated my correct post.

You write: There is no way to EASY access it without help of ISP.
You did NOT write: There is no EASY way to access it without help of ISP.
Note the big difference between the two sentences!
"there is no way to..." = you indicate it is impossible.
I wrote that this is not correct and that it IS possible, no more no less.

Be nice! You're in a forum full of non-native speakers (myself included), so arguing about expressions and making strong statements may not be the best thing to do. Post a correction if needed, but keep it pleasant. Just a suggestion...

Btw, "easy" is relative term. If ISP is not cooperative, then getting cheap VPS, setting up OpenVPN server, connecting router to it and forwarding some ports from there is no rocket science. Even a beginner should be able to do it (possibly with some help). But it's also true that it's kind of stupid and not very practical solution, because you'll end up with another machine to administer (even though it's mostly "set it & forget it" type of config), pay for (but some VPSes are really cheap these days), and traffic will first need to go somewhere else before it gets to you. But if you don't have any better option, why not. But the right way is to talk to ISP. If they don't have enough IPv4 addresses, fine, that's understandable. If they don't want to do port forwarding, still understandable, but the more reason to start with IPv6 as soon as possible.

Please do not make me the offender.

....Note the big difference between the two sentences!
"there is no way to..." = you indicate it is impossible.
I wrote that this is not correct and that it IS possible, no more no less.

If you write "completly incorrect" then you state that I am not aware of possibilities. I am aware. So you are "completly wrong" with your statement.

Let me emphasise the essence:
"no way to EASY ACCESS" is not the same as "NO EASY WAY to access" and "NO WAY to access".
It is same difference as "no EASY path to climb the mountain" and "no path to EASILY CLIMB the mountain".
Both sentences do not state that there is no possibility to climb this mountain. Note the big difference between these sentences!

P.S.
Please look at yours ".... you can always setup a VPN ..."
If you write that you should consider if you are sure that you are right. Isn't the pot calling the kettle black ?

Guys.... especially you three do not need to continue in this discussion. Taking small part and putting emphasis on it is not good way.

We all know that tunneling out can be solution for this task but how easy it is depends on the possibilities and experience of the administrator. So let's give him a hint and let him learn.

Buying a public ip from the isp is another option. Sometimes easy sometimes impossible...

I have a VPN Server in production only for OAM porposes... I can provide you 2xAccounts (1xTo you winbox machine, 1xTo your Mikrotik equipment).
You don't need need any additional configuration in your "inbox" machine.
You will need L2TP / IPSec command to run into your Mikrotik equipment...