More for Less: MikroTik Talk

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > More for Less: MikroTik Talk

morningdrew: Jul 18, 2003; It's toe-tapping-ly tragic!

I'm delving into the MikroTik world and I'm having a hell of a time with port forwarding. I followed the Anypony guide and although the forwarding works fine (I started with 80 and 443 to an SBS 2011 box and I can access it from the outside no problem) it kills any outgoing traffic to 80 and 443 from inside the network. I'm wondering if I screwed something up elsewhere in Winbox, or if I'm missing something. I'm running 5.5 on an RB750G (it had the same behavior before upgrading it to 5.5). Any help is appreciated.

# ¿ Jun 27, 2011 18:04

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 22:35

morningdrew: Jul 18, 2003; It's toe-tapping-ly tragic!

CuddleChunks posted:

Open up winbox, click on New Terminal on the left.
In the terminal window type: ip fire mang export

Right-click on the window and select "Copy All". Paste that into notepad, clean out any of the boring intro crap and paste the rules you wrote here. That should give us a clear idea of what your rules look like.

Here's all I got when I did that (I X'd out part of the ID since I'm not sure if that's a license key or not):

code:

[admin@MikroTik] > ip fire mang export
# jun/27/2011 02:21:41 by RouterOS 5.5
# software id = 36R3-XXXX
#

# ¿ Jun 27, 2011 19:23

morningdrew: Jul 18, 2003; It's toe-tapping-ly tragic!

CuddleChunks posted:

oops, try: ip fir nat export

Here you go:

code:

/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1-gateway
add action=dst-nat chain=dstnat disabled=no dst-port=3389 protocol=tcp to-addresses=10.10.1.16 to-ports=3389
add action=dst-nat chain=dstnat disabled=no dst-port=902 protocol=tcp to-addresses=10.10.1.245 to-ports=902
add action=dst-nat chain=dstnat disabled=no dst-port=443 protocol=tcp to-addresses=10.10.1.16 to-ports=443
add action=dst-nat chain=dstnat disabled=no dst-port=80 protocol=tcp to-addresses=10.10.1.16 to-ports=80

# ¿ Jun 28, 2011 15:10

morningdrew: Jul 18, 2003; It's toe-tapping-ly tragic!

CuddleChunks posted:

Those rules NAT everything hitting the ports. You need one more condition for them to trigger selectively. In my case, I put in my static IP from the WAN side so my rule looks like this:

/ip firewall nat add action=dst-nat chain=dstnat comment="" \
disabled=no dst-address=XX.XX.XX.XX dst-port=80 protocol=tcp \
to-addresses=192.168.17.3 to-ports=80

I've bolded the dst-address field to make it stand out more.

Awesome, looks like that's all I needed. Thanks! :waycool:

# ¿ Jun 28, 2011 17:50

morningdrew: Jul 18, 2003; It's toe-tapping-ly tragic!

Another fairly basic problem here:

I setup another 750G router with a static WAN address, and although the router can connect to the Internet fine (pinging 4.2.2.2 from Winbox responds) I can't get out with any other devices attached. I can ping the router fine, but nothing beyond it (cable modem IP, gateway, etc).

Any ideas?

# ¿ Jul 12, 2011 19:03

Adbot: ADBOT LOVES YOU

# ¿ Apr 25, 2024 22:35

morningdrew: Jul 18, 2003; It's toe-tapping-ly tragic!

I haven't changed any NAT rules, so whatever's there with a stock configuration is it (masquerade rule?)

# ¿ Jul 12, 2011 23:56

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > More for Less: MikroTik Talk