MikroTik

Posted: **Fri Jan 21, 2011 11:19 am**

Hi guys,
Any helps would be appreciated. Trying to get Hairpin NAT working on my LAN at home and followed the exact instructions as in http://wiki.mikrotik.com/wiki/Hairpin_NAT, which has not worked. Only difference is that I am using the 172.x.x.x addressing scheme over a bridged "LAN" interface.

/ip firewall nat
add action=masquerade chain=srcnat comment=NAT disabled=no out-interface=\
    "IBB DSL WAN"
add action=masquerade chain=srcnat comment="" disabled=no dst-address=\
    172.29.1.11 dst-port=80 out-interface=LAN protocol=tcp src-address=\
    172.29.1.0/24
add action=dst-nat chain=dstnat comment=MSTSC disabled=no dst-address=\
    83.141.117.106 dst-port=3389 in-interface="IBB DSL WAN" protocol=tcp \
    to-addresses=172.29.1.10 to-ports=3389
add action=dst-nat chain=dstnat comment="HTTP Server" disabled=no \
    dst-address=83.141.117.106 dst-port=80 in-interface="IBB DSL WAN" \
    protocol=tcp to-addresses=172.29.1.11 to-ports=80

[/size]

The other rules are just torrent and game forwarding rules to other machines.
Funny enough, on this Mikrotik I have 2 LANs. One handing out a 192 and the other handing out 172's with the HTTPS server physical connected to the Mikrotik but part of one of the LAN Bridges when the client is on either of these networks trying to connect to the HTTP server it just times out. I've also attached some wireshark captures. Any help would be appreciated.

172.29.1.10 is the client .11 is the HTTP server

Posted: **Fri Jan 21, 2011 11:26 am**

Try setting:

/interface bridge settings set use-ip-firewall=yes

Posted: **Fri Jan 21, 2011 11:30 am**

just did that and no difference at all, I can capture packets now if you wish based on that change!?

PS thanks for the fast response.

Posted: **Fri Jan 21, 2011 12:16 pm**

add action=dst-nat chain=dstnat comment="HTTP Server" disabled=no \
dst-address=83.141.117.106 dst-port=80 in-interface="IBB DSL WAN" \
protocol=tcp to-addresses=172.29.1.11 to-ports=80

It seems in-interface="IBB DSL WAN" is causing this problem. Http requests from LAN interface are not being DST-NATed to 172.29.1.11. Try to unset in-interface.

Posted: **Fri Jan 21, 2011 12:25 pm**

Problem with that is, thats the WAN interface in which WAN based clients will connect.

[EDIT] I stand very much corrected. I unset that, it neither worked for LAN or WAN based customer.
I then instead of unsetting "IBB DSL WAN" (which is the WAN ppoe dialer for the DSL) I used "DSL link" which is the actual physical port.

Thank you for all the help, that would have seemed to work perfectly.

Rattle

Posted: **Wed Jul 09, 2014 1:38 pm**

Hello,

I have same problem and i tried from many sites but still UN-successful can any body help me.

NAT- HairPin problem solved after upgrade router firmware

MikroTik

Hairpin NAT not working

Hairpin NAT not working

Re: Hairpin NAT not working

Re: Hairpin NAT not working

Re: Hairpin NAT not working

Re: Hairpin NAT not working

Re: Hairpin NAT not working