Community discussions

MikroTik App
  4. RouterOS
  5. Forwarding Protocols

Webserver NAT/Hairpin behind PPPoE

Post Reply
 
dg3feh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 68
Joined: Mon Jan 30, 2017 10:52 am

Webserver NAT/Hairpin behind PPPoE

Thu Mar 15, 2018 12:40 pm

Hello!

I am geting a bit nut with my firewall rules. My WAN connection is a PPPoE connection with a dynamic IP, the DynDNS works fine.

The local networks I use:

192.168.50.0/24 - only modem in
192.168.51.0/24 - main LAN
- Mikrotik Router 192.168.51.254
- Web-Server 192.168.51.230
192.168.53.0/24 - guest LAN
10.100.10.0/24 - OVPN dial in

The firewall looks like this:
Code: Select all
/ip firewall filter
add action=drop chain=input comment="Input kaputte Pakete Drop " connection-state=invalid
add action=drop chain=forward comment="Forward kaputte Pakete Drop\
    \n" connection-state=invalid
add action=fasttrack-connection chain=forward connection-state=established,related
add action=accept chain=input comment="Input related OK" connection-state=related
add action=accept chain=input comment="Input established OK" connection-state=established
add action=accept chain=forward comment="Forward related OK" connection-state=related
add action=accept chain=forward comment="Forward established OK" connection-state=established
add action=accept chain=input comment="Input aus privaten LAN OK" in-interface=private-lan-bridge
add action=accept chain=forward comment="Forward aus privaten LAN OK" in-interface=private-lan-bridge
add action=accept chain=forward comment="Forward Modem LAN auf Server" dst-address=192.168.51.230 src-address=192.168.50.0/24
add action=accept chain=Input comment="Input Modem LAN auf Server" dst-address=192.168.51.230 src-address=192.168.50.0/24
add action=accept chain=input comment="Input aus OVPN LAN OK" src-address=10.100.10.0/24
add action=accept chain=forward comment="Forward aus OVPN LAN OK" src-address=10.100.10.0/24
add action=accept chain=forward comment="Forward Gast-Lan -> Internet" in-interface=gast-lan-bridge out-interface=PPPoE-Telekom
add action=accept chain=input comment="DNS/NTP-Zugriff Gast-LAN" dst-address=192.168.51.254 dst-port=53,123 in-interface=gast-lan-bridge protocol=udp
add action=accept chain=forward comment="Webserver-Zugriff aus Gast-LAN" dst-address=192.168.51.230 dst-port=80,443 in-interface=gast-lan-bridge protocol=tcp
add action=accept chain=input comment=OpenVPN dst-address=192.168.51.254 dst-port=1194 in-interface=PPPoE-Telekom protocol=tcp
add action=accept chain=forward comment=Webserver dst-port=80,443 in-interface=PPPoE-Telekom protocol=tcp
add action=drop chain=input comment="Der Rest geht in den Orkus...." log-prefix=FW
add action=drop chain=forward log=yes log-prefix=DROP
/ip firewall nat
add action=masquerade chain=srcnat comment="Maskierung LAN" out-interface=PPPoE-Telekom src-address=192.168.51.0/24
add action=masquerade chain=srcnat comment="Maskierung Gast-LAN" out-interface=PPPoE-Telekom src-address=192.168.53.0/24
add action=masquerade chain=srcnat comment="Maskierung VPN Netz" src-address=10.100.10.0/24
add action=masquerade chain=srcnat comment="Hairpin Web-Server" dst-address=192.168.51.230 dst-port=80,443 log=yes log-prefix="APA-MASQ: " out-interface=\
    private-lan-bridge protocol=tcp src-address=192.168.51.0/24
add action=dst-nat chain=dstnat comment="Port-forwarding HTTPS zum Server" dst-address=!192.168.51.254 dst-port=443 in-interface=PPPoE-Telekom log-prefix=\
    "APACHE443: " protocol=tcp to-addresses=192.168.51.230 to-ports=443
add action=dst-nat chain=dstnat comment="Port-forwarding HTTP zum Server" dst-address=!192.168.51.254 dst-port=80 in-interface=PPPoE-Telekom log-prefix="APACHE80: " \
    protocol=tcp to-addresses=192.168.51.230 to-ports=80
add action=dst-nat chain=dstnat comment="Port-forwarding OVPN" dst-port=1194 in-interface=PPPoE-Telekom protocol=tcp to-addresses=192.168.51.254 to-ports=1194
In this configuration the traffic from the outside to the Web-Server works fine. If I add to this filter rule
Code: Select all
add action=accept chain=forward comment=Webserver dst-port=80,443 in-interface=PPPoE-Telekom protocol=tcp
the Webservers IP as destination address, all traffic ist droped by the last rule. Why?

Beside that the Hairpin doesn't work at all. I end up on the routers webinterface and not on my webserver 192.168.51.230. I followed the mikrotik wiki: https://wiki.mikrotik.com/wiki/Hairpin_NAT

Does anyone has a hint for me?


Thanx!

Holger
Top
 
2frogs
Forum Veteran
Forum Veteran
Posts: 713
Joined: Fri Dec 03, 2010 1:38 am

Re: Webserver NAT/Hairpin behind PPPoE

Thu Mar 15, 2018 1:46 pm

Your dstnat rules only work for traffic coming in on PPPoE-Telekom since you have that as in-interface. And since your local traffic does not come in on this interface it does not match the rule. It works fine for connecting from remote locations, but you need to change it to have either dst-address=x.x.x.x or dst-address-type=local.
Top
 
dg3feh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 68
Joined: Mon Jan 30, 2017 10:52 am

Re: Webserver NAT/Hairpin behind PPPoE

Thu Mar 15, 2018 5:03 pm

Hello!

Thanks for ur help! I changed the dst-nat to
Code: Select all
add action=dst-nat chain=dstnat comment="Port-forwarding HTTPS zum Server" dst-address=!192.168.51.254 dst-address-type=local dst-port=443 log-prefix="APACHE443: " \
    protocol=tcp to-addresses=192.168.51.230 to-ports=443
add action=dst-nat chain=dstnat comment="Port-forwarding HTTP zum Server" dst-address=!192.168.51.254 dst-address-type=local dst-port=80 log-prefix="APACHE80: " \
    protocol=tcp to-addresses=192.168.51.230 to-ports=80
and now it works even from inside!

But if want to limit the port 80,443 forward filter to the webserver 192.168.51.230 like this:
Code: Select all
add action=accept chain=forward comment="Webserver-Zugriff aus Gast-LAN" dst-address=192.168.51.230 dst-port=80,443 in-interface=gast-lan-bridge protocol=tcp
all packages are dropped. with a blank dst-address it works. I want to understand why. Isn't the local IP address of the server the destination?

BR

Holger
Top
 
Sob
Forum Guru
Forum Guru
Posts: 9188
Joined: Mon Apr 20, 2009 9:11 pm

Re: Webserver NAT/Hairpin behind PPPoE

Thu Mar 15, 2018 7:55 pm

Yes, in forward chain, connections to local webserver will have dst-address=192.168.51.230, so it should work. You can also take a shortcut and allow all forwarded ports at once:
Code: Select all
/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat
Top
 
dg3feh
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 68
Joined: Mon Jan 30, 2017 10:52 am

Re: Webserver NAT/Hairpin behind PPPoE

Thu Mar 15, 2018 8:23 pm

Strange, but it doesn't work with an explicit destination IP.

I have now an additional problem. I want to route http://<external-ip>:8100 to another webserver 192.168.51.231.
Code: Select all
add action=accept chain=forward comment=Heatermeter disabled=yes dst-port=8100 log=yes log-prefix=HM-forward: protocol=tcp
add action=masquerade chain=srcnat comment="Hairpin Heatermeter" dst-address=192.168.51.231 dst-port=80 log=yes log-prefix=HM-Hair: out-interface=\
    private-lan-bridge protocol=tcp src-address=192.168.51.0/24
add action=dst-nat chain=dstnat comment="Port-forwarding HTTP zum Heatermeter" dst-address=!192.168.51.254 dst-address-type=local dst-port=8100 log=yes \
    log-prefix="HM-NAT: " protocol=tcp to-addresses=192.168.51.231 to-ports=80
As fare as I have understood:

dst.nat: 8100 is the external port which is redirected to the to-address and to-port
hairpin: exverthing from local lan to port 80 of the webserver is masqueraded
forward: opening the external port 8100

About ur rule regarding the connection-nat-state I have to think over. I like explicit rules more ;)
Top
Post Reply
  4. RouterOS
  5. Forwarding Protocols