MikroTik Hairpin NAT

Having issues with accessing your webserver from within the same LAN network? Hairpin NAT or also called Loopback NAT will help you.
Documentation is here: help.mikrotik.com/docs/displa...

[@oliver1121]

I'm a Network Engineer and I learnt something! I had heard the term Hairpin NAT, but had never looked into it before. Thank you for explaining WHY you would use Hairpin NAT, it makes sense and I can see the use cases :)

[@Anavllama]

Its often done on other routers by a checkbox called Loop back.

[@flisskennigen4675]

Me too. Although I have a decade of enterprise networking experience, I always learn something from these videos - even if I already "know" the answer.

[@pedrojunior8530]

I'm discovery this alone... on dificults of day of day... but, this information is amazing on these format! Thanks Mikrotik! 😊

[@salembaabbad8783]

When i see a new video of you thats make feel very happy 😊

[@katsurokurosaki7230]

Now this is a nice one! I have static DNS entries with the local addresses on the server subnet, but now I can have piece of mind by removing all the DNS entries and "fix" it with a simple firewall rule. No more forgetting to add/remove domains. Thanks a lot!

[@DickyChengHK]

Thanks. Seems it is one of the favorite FAQ for user migrate to use Mikrotik router and finally get the official answer.

[@SergeyKo.]

Thank you very much. He explained everything very clearly.

[@OsbertMagara]

THANK YOU SOO MUCH. IT IS WORKING AND YOU HAVE SAVED ME

[@vladislavkaras491]

Great explanation! Thank you!

[@squid11160]

Now, if you want multiple websites/services on a single port (for example 443) I think you'd need to internally target a reverse proxy which then distributes request to targets based of URL. This can also simplify the https setup to a only that reverse proxy. I still recommend using at least self signed certificates on the final backends.

[@jakirbasha69]

This is why i love mikrotik for routing love from India.

[@roxorbeton]

This settings works like a charm :)

[@frostbite1991]

Worked great for allowing access to my Blue Iris webserver by using WAN IP on WiFi. Now I wont need 2 hyperlinks to choose from depending on whether I'm on WiFi or mobile network to check my cams!

[@neilvermeulen5283]

Thank you. This helped

[@tech-kyle]

I just recently discovered src-nat masquerading when I was trying to solve the issue of getting into a VPN client's network from the host's public when the client was set up for split tunneling. I had the same basic problem. I wanted to port-forward from my host network's public IP over the VPN to a client that only had internet access through CG-NAT. Packets would dst-nat to the server behind the VPN client but exit out the CG-NAT connection via the default route. The solution was to src-nat & masquerade all ppp connections. Hard not to love MikroTik the more I learn with them.

[@kchiem]

For the hairpin rule, why wouldn't you just set dst-address=10.0.0.0/24 for your LAN instead of a particular IP, to handle all your port forwards, instead of just the one for that server?

[@antonioalbert1877]

Just because he's not lazy.

[@drumaddict89]

great shirt! :)

[@ivicastojadinovic9907]

There also example using connection mark without using out interface for masquerade if we use the general rule for all posible nat reflections with LAN and WAN address lists.

[@j7ndominica051]

You can fool a program that refuses to connect to localhost into thinking the server is actually on the internet, or the other way around. I love how on Mikrotik we can have many combinations of nats simultaneously active.

[@tekniqal2639]

I have been wanting to make this work literally for years. This did the trick. I had not realized before that there is no need for selecting the WAN as the "in interface" for port forwarding rule. Once I removed that from my rule(s) the hairpin rule magically started working. One down, one to go. Can you cover how to configure dual WAN (DHCP, not static, addressing) with failover/load balancing? It'd be much appreciated.

[@blackadam23]

Got it to work thanks. Only thing I am logically confused about is why the server is in the DST address field when setting up the hairpin NAT rule. Shouldn't it be in the SRC, since the issue is the PC (client) getting the answer from internal server IP causing the issue. I assume it's about how the connection is started / established, and that's why server has to go in DST? Afterwards the router treats the whole connection with action = masquerade?

[@AGAGARCIA]

Excelent!

[@aszandek]

Hi, Thanks that! How can this work if the server on a VLAN and the local PC is on the bridge? That settings will work? I do not think so. VLAN managed on Layer 2, NAT may on Layer 3 or am I wrong? Thanks any.

[@alimibrahem8120]

As far as i know the dst nat rule doesnt work at all in case of the insider request that contain the public ip, and in 2:20 you say that the server see the request came from the 10.0.0.2 🤔..? What I understand from this statement is that the dst nat rule is worked when this request come and the output result of this request is 10.0.0.3 duo to the predefined rule, that is make the server see that the request from 10.0.0.2 Is that correct..? Please can you explain.??

[@bucharestcartraffic]

Advantage/Disadvantage vs the Split DNS way ???

[@jakezxz1352]

But the server receives the packet with the source IP of the Public IP of the router - Why would it know anything about the end host?

[@fish_bacon]

My prayers answered! sick of putting local IP to DNS in the hosts file!

[@TanKianW79]

That is also called NAT reflection.

[@rodneyyeo7744]

What happens when you public ip is dynamic address via PPPoE interface?

[@willyelvis9369]

New video o/ ❤

[@Aviduduskar]

Nice to have, but for a LAN, it may be less convoluted to simply set this up in DNS - point the web URL to the internal web server IP.

[@sylvavert2161]

The end of video 3:54 seems wrong. I think the correct one is ...and puts the original destination IP address of 172.16.16.1 into the source IP address field, and the original source IP address of 10.0.0.2 into the destination IP address field.

[@zemeroff]

a more productive solution in the described example would be a static dns entry with a local ip

[@nickd6677]

Can you explain why?

[@mikrotik]

He is not correct. Accessing by LAN IP will give you false sense of “it’s all working” when it may be not working from public IP for your regular website viewers. If you want to see your server in the same way as your other visitors, you must access it the same way.

[@livankiv]

In my opinion, it is better to use static DNS for this purpose. This is because in investigation processes, you will see no source address in the application log.

[@mikrotik]

Accessing by LAN IP will give you false sense of “it’s all working” when it may be not working from public IP for your regular website viewers. If you want to see your server in the same way as your other visitors, you must access it the same way.

[@livankiv]

Of course, you are right, but i'm talking about visibility, not accessibility

[@festuc]

@@mikrotik but if you are under dynamic IP public address static dns it's the only solution because you don't allow DST Ip has a dinàmic name

[@mikrotik]

No, but there are other ways to solve it. Static DNS is direct way to undiagnosed network problems.

[@Anavllama]

You have an error in paragraph 2 showing at time 3:23, SPECIFICALLY, paragraph 2. The first sentence is correct but the second sentence should state: "The source IP address 10.0.0.2 is sourcenatted to the lP address of the LAN interface 10.0.0.1 which should be displayed ( as per your own words! ).

[@mfarokh27]

I was going to point out this exact same thing too😅

[@Anavllama]

@@mfarokh27 Thats okay it was a beta video jajajajaja

[@mfarokh27]

@@Anavllama 😂

[@G00glieS]

That will hide source IP in the web server logs. It’s a workaround.

[@pardillos]

Thank You for the video. One cuestion, ¿It work if I dont have a fixed IP public?. I work with the cloud IP of MK.

[@mikrotik]

If you don't have a fixed IP, you could use MikroTik Cloud DNS name, then purchase a domain name and use that as CNAME alias. Your IP still needs to be a public IP.

[@hey_leao]

it will work with no problems.

[@hey_leao]

@@seantellsit1431 i use like he said in the vídeo and i have a dynamic IP address.

[@mikrotik]

yes, Sean is right, if your Hairpin NAT rule references a specific IP address, it will stop working if your public IP changes. Some scripting will be required in addition to what is in the video.

[@D9ID9I]

But in this scenario all requests from lan to 10.0.0.3 will work like you talk to 172.16.16.1. And this is not the expected behaviour. I think we need better solution.

[@Hun73rdk]

Never got it to work at all

[@semtex6412]

...or i can just static dns mapped to the LAN IP, right?

[@mikrotik]

That way you will not know if your real visitors can also open your site, any dns issue could be missed. Also your public IP could change and you would not notice. Always test 1:1 just like your customers will see your page

[@nick9323]

Make a video about multicast vxlan please

[@valirmasha4718]

Could you show me how to limit clients download speed big files but if clients browser normal internet they will get max speed. I have tried queue but not working.

[@mikrotik]

Router doesn’t know which file is big, because it has not seen it yet. So it’s not possible. You can use Burst function to allow fast speed for a few seconds and the slow down the download. It will have a similar effect

[@valirmasha4718]

@@mikrotik Could you please give me how to use Burst function ?

[@fluppir]

Hi there - thank you for these informed videos. I am posting here, as this actually gets some attention. We run an enterprise size network with Mikrotik only, and have some very intricate setups, with intricate questions. Why won't you please consider creating expert paid support, so we can have your engineer inputs on demand ? Also, I am sure that when you can get info about big setups, you can build your software better. Thank you

[@mikrotik]

We actually do have paid support. Check this link for information mikrotik.com/consultants

[@fluppir]

@@mikrotik no that’s not your engineers that are doing support. Those are people having studied your courses. We are looking for direct support from your own Mikrotik engineers and design team, and are willing to pay for that.

[@mikrotik]

We do not provide such services. Our engineers are busy making products.

[@somethingidk8875]

@@fluppir a correct answer is a correct answer, regardless of the source. there are plenty of resources available. if you NEED something THAT boutique and customized and your configs are THAT complex, you're probably designing your networks sub-optimally. i'd look at why you think you require this level of support in the first place.

[@stefanhoelzl]

@MikroTik, in my PortForward rules, I an bit able to configure a static "destination ip", since it's a rotating ip address of my ISP. So I thought to configure In.Interface "WAN" instead of the "Dst. IP".. but by that, all traffic is masqeraded to the webserver ^^. Did I miss anything?

[@Dgeigerd]

Thought someone would ask that. I have the same issue, i commented that (or more) Rule with "HNAT" and then wrote a small script that takes the external IP from either WAN Interface or the IP/Cloud Menu and puts it in every NAT Rule with the Comment "HNAT" as Destination IP. Run that every 5 Minutes or wo, works great so far! Also my Cloudflare DynDNS Script works awesome to renew DNS Entries when it's changed

[@stefanhoelzl]

@@Dgeigerd would you share this script with me?

[@fl4co_]

What if you have a dynamic public IP address?

[@bananeta]

ddns

[@pedro_8240]

In my home network I have my own DNS server, so I just redirect the address directly to the internal IP of the server, completely bypassing the router.

[@mikrotik]

You are missing the point of the issue. If you use your own dns, you have a different usage experience than your website visitors. If your website is configured incorrectly or is having a dns problem, you will not see it. Using hairpin NAT helps you to see your website just like all the other users.

[@tutugreen_dayo]

😋fullcone nat (3-tuple) on routeros, it that possible?

[@MyAeroMove]

Other vendors have this feature by default for 10+ years. Mikrotik is still not there 😭

[@mikrotik]

We have this feature for more than 20 years

[@MyAeroMove]

@@mikrotik "by default" = out of the box = no configuration needed IMO with Mikrotik it's an advanced topic and very setup/configuration specific.

[@mark.gl1800]

@@MyAeroMove Use "by default" dvice and maybe it' yur advanced style) But we love MT advanced zeeroconf style (' ')

[@tekniqal2639]

spoke too soon. Doing this method broke my internet. It would be nice if in these videos they actually showed all this working. Just do not understand why Mikrotik simply does not have a dedicated setting for hairpin like other router OSes. Just frustrating.

[@josephjansenvanvuuren5314]

Thanks Obi-Wan Kenobi

[@Anavllama]

Why not access your server by LANIP............... ;-) Excellent visual representation.

[@mikrotik]

Accessing by LAN IP will give you false sense of “it’s all working” when it may be not working from public IP for your regular website viewers. If you want to see your server in the same way as your other visitors, you must access it the same way.

[@Anavllama]

@@mikrotik That has nothing to do with hairpin nat which is not required for external access. Wrong thinking. One can easily check reaching a server by using cellular service or ask a friend.

[@mikrotik]

This is truly bad advice.

[@Anavllama]

@@mikrotik Nice an opinion with no facts. Keep up the misinformation.

[@mikrotik]

I already clarified why it's bad advice above your comment. If you are using a different IP to access your webserver, you will not get the same experience as your real users from the internet side. If your public IP stops working, your internet connection has issues, you will not see this, because it will work for yourself.

[@Victoare]

Really helpfull, but maybe it's just me but it is a bit confusing to read at 3:30 from the text that the "source ip address stays the same : 10.0.0.2" and you say the router srcnat-ed the source address to 10.0.0.1 (thus the packet will go back to the router) Or maybe i'm not really familiar with the lingo at this point.

[@wowueh2]

Me too

[@SY1337]

the only acceptable solution is split-dns.

[@mikrotik]

That is not correct. Accessing by LAN IP will give you false sense of “it’s all working” when it may be not working from public IP for your regular website viewers. If you want to see your server in the same way as your other visitors, you must access it the same way.

[@petrnovak8565]

there is one other solution in some non RouterOS firewalls - DNS rewrite option in NAT translation

[@JanisJaunosans]

star wars, star wars, seaguls

[@Dnsmel]

or, u can use dst-address-type=local add action=dst-nat chain=dstnat dst-address=YOUR_PUBLIC_IP dst-address-type=local \ dst-port=8000 protocol=tcp to-addresses=172.25.50.2 to-ports=8000

[@achud]

What if we have several devices working in the same network on the same port and a dynamic IP address on the gateway (public IP) Is this configuration (it definitely works) but correct? /interface list add name=WAN add name=LAN /interface list member add interface=br0 list=LAN add interface=sfp1 list=WAN /ip cloud set ddns-enabled=yes ddns-update-interval=5m /ip firewall address-list add address=xxxxxxxxxxxx.sn.mynetname.net list=WAN-IP /ip firewall nat add action=dst-nat chain=dstnat dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=192.168.88.2 to-ports=443 add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=WAN add action=dst-nat chain=dstnat dst-address-list=WAN-IP dst-port=443 protocol=tcp to-addresses=192.168.88.2 to-ports=443 add action=masquerade chain=srcnat dst-address=!192.168.88.1 out-interface=br0 protocol=tcp src-address=192.168.88.0/24

[@maciejsiakowski5929]

AFAIK 172.16.x.x is a private IP pool.

[@mikrotik]

Would you rather us give a real existing IP in the example?