Page 1 of 1
basic port foward easily achieved by cheap routers. NOTonMT
Posted: Wed Feb 20, 2013 4:34 pm
by cylent
I've been fighting with this issue for a few days now.
I have a server behind my RB1100 that has HotSpot/PPPoE.
All seems to be working just fine for the MTRouter which is great.
I just need to port forward port 8787 so when i type my external IP with port 8787 (1xx.224.27.xxx:8787) it sends me to my internal server so i can get to it.
I have created the following rule:
8 ;;; port forward
chain=dstnat action=dst-nat to-addresses=192.168.8.1 to-ports=8787
protocol=tcp port=8787
yes. the server is on a different subnet (192.168.8.0/29). It also is on a different port (5)... however all is well since MT can ping it just fine:
[admin@Mikrotik] > ping 192.168.8.1
HOST SIZE TTL TIME STATUS
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
192.168.8.1 56 64 0ms
sent=5 received=5 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Wed Feb 20, 2013 7:38 pm
by jp
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Wed Feb 20, 2013 8:39 pm
by cylent
I don't want to sound rude but that's not much help. I've already created that rule missing only the external ip as in the example 69.69.69.69
The problem here is how can a simple cheap routes be it tp_link or linksys do what's needed so easily while I can't do it in RouterOS
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Wed Feb 20, 2013 9:15 pm
by SurferTim
What does this mean?
I have a server behind my RB1100 that has HotSpot/PPPoE.
Is the server on an interface with a hotspot?
The server is assigned 192.168.8.1/29? What is the MikroTik router interface assigned on that localnet? The reason I ask is because I normally assign an address like 192.168.8.1 to my router interface, not devices behind it.
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 12:24 am
by cylent
The server (192.168.8.1) is on an interface thats no where near the hotspot/pppoe on the mikrotik.
Ether1 is for net.
Ether5 is for the server (192.168.8.1)
ports 6-11 are bridged to make one port and thats what the hotspot/pppoe is on.
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 1:08 am
by jp
created that rule missing only the external ip as in the example 69.69.69.69
That could be why it's doesn't work.
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 1:28 am
by SurferTim
You didn't answer my question. What ip is ether5 assigned? Are you certain the default gateway in the server is correct? It needs to be that ip.
If you want specific answers, you must provide specific information.
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 5:30 am
by cylent
ether5 is 192.168.8.2/29
server is 192.168.8.1/29
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 8:29 am
by kgninfos
Use this
add action=dst-nat chain=dstnat dst-address=pubic_ip dst-port=8787 protocol=tcp to-addresses=192.168.8.1 to-ports=8787
if static public ip is assigned to ether1
or else
add action=dst-nat chain=dstnat in-interface=ether1 dst-port=8787 protocol=tcp to-addresses=192.168.8.1 to-ports=8787
if you have changed the replace ether1 with actual port name(Case sensitive)
give +1 karma if this helped you
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 2:03 pm
by SurferTim
The server has 192.168.8.2 as the assigned gateway? Nothing in the firewalls (router or server) that could be blocking this?
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 2:55 pm
by rjickity
Supply the in-interface like advised above and it will work.
If it doesn't, show us /ip firewall filter export compact
Without more info you wont get much help
Re: basic port foward easily achieved by cheap routers. NOTo
Posted: Thu Feb 21, 2013 4:17 pm
by SurferTim
I just tested this on my router with an internal server at 192.168.1.254. It works fine without an in-interface or dst-address parameter.
/ip firewall nat
add chain=dstnat action=dst-nat dst-port=8088 to-addresses=192.168.1.254 to-ports=80 protocol=tcp
This accessed the internal server from the internet.
http://xx.xx.xx.xx:8088
edit: I also tried the same using port 80 on both, and I could access the server from the internet.
/ip firewall nat
add chain=dstnat action=dst-nat dst-port=80 to-addresses=192.168.1.254 to-ports=80 protocol=tcp
This accessed the internal server from the internet.
http://xx.xx.xx.xx
HOWEVER, this redirects all port 80 destination traffic to 192.168.1.254. The internet became unreachable from internal computers. In that case, an in-interface or dst-address would be necessary to work properly.