Mikrotik with Multiple WAN IP’s and Port Forwarding / HAIRPIN NAT ~ Learn It

Mark my words !

MIKROTIK is the Future & Cisco’s Domination is about to end.
For sure CISCO still holds the majority of shares in routers world, but it will going to change very soon . . .
CISCO is best, but at higher price. Cisco have edge dueto reliable OS and Hardware.
Mikrotik is good for multi purpose in a very cheap price as compared to CISCO and offer more. So very cost effective solution.
Its all about personnel preference, choice, budget.
But Even if i have high budgeting, I will prefer Mikrotik

, buts that’s my personnel choice. and you are not bound to agree with it

Jz
↓
Recently I did some testing at my office for a possible replacement of Cisco ASA 5510 Firewall/Router with Mikrotik Router-board. Following are some short reference on how I did it. I had a /29 public ip pool. Configuration was was pretty straight forward but i was confused on howto route specific LAN server (or ip) traffic with Specific WAN ip. Using src-address I managed to solve it. Following are short reference for future usage.
Scenario is as follows
We will configure all useable WAN ip addresses in mikrotik wan interface, and we will forward required ports from specific wan ip’s to specific lan servers. we will also configure firewall so that only required ports are open from WAN side for security purposes, all other traffic will be denied on WAN interface. We will also bind local servers with specific WAN ip addresses.
Mikrotik have two interfaces.

ether1 = LAN users
ether2 = WAN Link

Now we want to forward traffic as follows. (all ip scheme used here is fictional and for example purposes only)

mail server = 10.0.0.2 → 1.2.3.1    WAN IP
dude server = 10.0.0.3 → 1.2.3.2 WAN IP
cctv1 server = 10.0.0.4 → 1.2.3.3   WAN IP
cctv2 server = 10.0.0.5 → 1.2.3.4   WAN IP

IP Configuration at Mikrotik Interfaces . . .

/ip address

add address=10.0.0.1/8 comment=LAN disabled=no interface="LAN - ether1"

add address=1.2.3.1/29 interface="WAN - ether2"

add address=1.2.3.2/29 interface="WAN - ether2"

add address=1.2.3.3/29 interface="WAN - ether2"

add address=1.2.3.4/29 interface="WAN - ether2"

↓

Filter Rules Section to allow only required Incoming traffic on WAN interface, and DENY all other for security purposes

Now we will first add required ports in firewall filter BEFORE DENY rule which is in last.

/ip firewall filter

add
 action=accept chain=input comment="SMTP" disabled=no 
dst-address=1.2.3.1 dst-port=25 in-interface="WAN - ether2" protocol=tcp

add
 action=accept chain=input comment="POP3" disabled=no 
dst-address=1.2.3.1 dst-port=110 in-interface="WAN - ether2" 
protocol=tcp

add
 action=accept chain=input comment="Webmail" disabled=no 
dst-address=1.2.3.1 dst-port=80 in-interface="WAN - ether2" protocol=tcp

add
 action=accept chain=input comment="DUDE" disabled=no 
dst-address=1.2.3.2 dst-port=80 in-interface="WAN - ether2" protocol=tcp

add
 action=accept chain=input comment="CCTV 1" disabled=no 
dst-address=1.2.3.3 dst-port=81 in-interface="WAN - ether2" protocol=tcp

add
 action=accept chain=input comment="CCTV 2" disabled=no 
dst-address=1.2.3.4 dst-port=82 in-interface="WAN - ether2" protocol=tcp

add action=accept chain=input comment="WINBOX 8192" disabled=no dst-port=8192 in-interface="WAN - ether2" protocol=tcp

add action=accept chain=input comment="Allow PING ICMP " disabled=no protocol=icmp

add action=drop chain=input comment="DROP ALL INCOMING TRAFFIC ON WAN INTERFACE" disabled=no in-interface="WAN - ether2"

↓

NAT Section To Do Port Forwarding From WAN ip’s To Local Server’s and use src-nat to bind local server to route traffic via specific WAN IP

### First dst-nat section to forward port

/ip firewall nat

add
 action=dst-nat chain=dstnat comment="SMTP 25 Forward to MAIL-Server" 
disabled=no dst-address=1.2.3.1 dst-port=25 in-interface="WAN - ether2" 
protocol=tcp to-addresses=10.0.0.2 to-ports=25

add
 action=dst-nat chain=dstnat comment="POP3 110 Forward to MAIL-Server" 
disabled=no dst-address=1.2.3.1 dst-port=110 in-interface="WAN - ether2"
 protocol=tcp to-addresses=10.0.0.2 to-ports=110

add
 action=dst-nat chain=dstnat comment="Web 80 Forward to MAIL-Server 
Webmail" disabled=no dst-address=1.2.3.1 dst-port=80 in-interface="WAN -
 ether2" protocol=tcp to-addresses=10.0.0.2 to-ports=80

add
 action=dst-nat chain=dstnat comment="Web 80 Forward to DUDE" 
disabled=no dst-address=1.2.3.2 dst-port=80 in-interface="WAN - ether2" 
protocol=tcp to-addresses=10.0.0.3 to-ports=80

add
 action=dst-nat chain=dstnat comment="CCTV1 - 81 Forward to cctv1" 
disabled=no dst-address=1.2.3.3 dst-port=81 in-interface="WAN - ether2" 
protocol=tcp to-addresses=10.0.0.4 to-ports=81

add
 action=dst-nat chain=dstnat comment="CCTV2 - 82 Forward to cctv2" 
disabled=no dst-address=1.2.3.4 dst-port=82 in-interface="WAN - ether2" 
protocol=tcp to-addresses=10.0.0.5 to-ports=82


### Now route specific local servers traffic from specific WAN IP address


add action=src-nat chain=srcnat comment="Rotue mail traffic via 1.2.3.1" disabled=no src-address=10.0.0.2 to-addresses=1.2.3.1

add action=src-nat chain=srcnat comment="Rotue DUDE traffic via 1.2.3.2" disabled=no src-address=10.0.0.3 to-addresses=1.2.3.2

add action=src-nat chain=srcnat comment="Rotue CCTV1  traffic via 1.2.3.3" disabled=no src-address=10.0.0.4 to-addresses=1.2.3.3

add action=src-nat chain=srcnat comment="Rotue CCTV2  traffic via 1.2.3.4" disabled=no src-address=10.0.0.5 to-addresses=1.2.3.4


add
 action=masquerade chain=srcnat comment="Default Masquerade Rule for 
LAN" disabled=no out-interface="WAN - ether2" 
src-address=10.0.0.2-10.0.0.255

☺
Now test it from WAN side. You can check port status from http://www.yougetsignal.com/tools/open-ports/
♣ ♣ ♣

<< HAIRPIN NAT >>

Using above method, I was ablet o successfully setup a port forwarding on a Mikrotik router that do port forwarding from mikrotik wan ip to local lan servers (Example: 1.2.3.4:3389 to 192.168.1.10:3389)
BUT there is a BUT, when I tried to open Mikrotik WAN ip from local LAN user, for example

192.168.1.20 –> 1.2.3.4:3389 –> 192.168.1.10:3389

it didn’t opened and the connection goes in SINK hole, means lost.
The solution was to rewrite the port forwarding rule to NOT to use in-interface=WAN-GATEWAY, but dst-address-type=local
This is called – among other terms – hair pin NAT because the traffic flow has clients enter the router through the same interface it leaves through, which when drawn looks like a hair pin.
As showed in the example below . . .

# DST-NAT rule to redirect port 3389 from

/ip firewall nat

add
 action=dst-nat chain=dstnat disabled=no dst-address=1.2.3.4 
dst-address-type=local dst-port=3389 protocol=tcp 
to-addresses=192.168.1.10 to-ports=3389 comment="Redirect RDP PORT  TCP 
3389 to local server"


# Masquerade local traffic going to mikrotik WAN IP - [To access that service from LAN using mikrtoik wan ip]

/ip firewall nat

add
 chain=srcnat src-address=192.168.1.0/24 dst-address=192.168.1.10 
protocol=tcp dst-port=3389 out-interface=LAN-Interface action=masquerade
 comment="Masquerade Traffic going to WAN IP of mikrotik from local LAN 
users"

Regard’s

Please Give Us Your 1 Minute In Sharing This Post!

SOCIALIZE IT → ,

Learn It

Sunday, 24 November 2013