MikroTik Router OS Hairpin NAT with Dynamic WAN IP and port forwarding

In this video I go over my fairly well polished MikroTik RouterOS way of getting a hairpin NAT solution and ensuring it has the ability to adjust itself dynamically as and when your WAN IP changes.
It's super easy, free and requires only a slight change in how you normally apply port forwards.
Find more MikroTik tutorials in my channel or on my websites at www.steveocee....
miknet.co.uk

[@boryswwa]

FINALLY someone explained this to me in a way that I'm able to understand and implement. I've been struggling with this for few days now. There are many videos about how to set this up, but none worked for me, until I found this explanation. (First - Hairpin NAT rule should be ABOVE the regular masquerade rule. Second - the trick with dynamic public IP mapping to Address List). THANKS!

[@SteveoceeCoUk]

Glad you enjoyed. Thank you

[@donEthano]

I've been struggling with port forwarding on :80 for quite some time, untill I've found THIS GOLD!!! Thank You Very Much!!!!!!!!!!! Great tutorial, 100% worked for me.

[@SteveoceeCoUk]

Glad I could help!

[@rodneyyeo7744]

Yes, your guide help me too. Thanks alot! ❤

[@skysurfer]

You have the gift my friend, taking a complicated subject and breaking it down into steps that are understandable. There are a lot of over engineered solutions to this, and yours is by far one of the easiest to comprehend. Worked for me on the first go. The humor in the video was also appreciated :)

[@LucianPantea]

By far the best explanation on how to set hairpin NAT. Thank you! This helped me and was extremely informative.

[@darkog9767]

The best explanation on hairpin NAT with Dynamic IP. Thank you!

[@pieterbeukes6294]

Awesome, someone explaining Hairpin NAT straight forward and so easy to implement

[@lolicolonlinez8844]

This is by far the easiest way to fix this issue. Thank you, you saved me hours!

[@vk1nfi]

MATE THANK YOU! I have been wanting to do this ever swapping to Mikrotik, but just put up with the fact it didn't work. But today I have recently needed it to work and after pulling out what little hair I have left all day. I have sat down with a beer and found your video. You are a dead set legend and I wish I could shout you a beer!

[@SteveoceeCoUk]

Glad it worked for you. Thanks for the view.

[@AttilaMatolcsy]

I almost left a keyboard smash here in my happiness. THANK YOU! It's finally working for me.

[@jpdub45]

I've been trying to figure this out for home assistant/ duckdns for probably 6 hours today, and your video has been the first helpful thing I've found today. Thank you!!!

[@_Callum.22]

I've struggled for months to get this to work - I had to watch your video twice, but this finally fixed it! The dynamic IP part was a bonus, too!

[@SteveoceeCoUk]

Glad it helped. Thank you for the watch time.

[@lestatt77]

I truly appreciate your tip, I have been trying to do hairpin NAT for a while now

[@anthsham]

I have been looking for a solution to this problem for longer than I care to admit. Thank you!

[@UltimateByte]

Thank you so much for this! I didn't find any documentation providing a rule that would work (at all and on top of that) for everything at once before yours. Also I'm now using address lists thanks to you! Cheers mate!

[@arogantech]

The BEST explanation on how to configure hairpin. THANK YOU!!

[@SteveoceeCoUk]

Glad you liked it, thank you.

[@biv88]

Thank you this should be page one on search engines not a random link on the forums

[@KarlHamilton]

Aaah. Very clever. But even more importantly, very elegant! Just what I need. Subscribed.

[@igradeanu]

Amazing clear and funny explanation! After searching around for quite some time, this helped me a lot! Let alone the lovely English accent. :)

[@wanttotree]

Hey this one helped me a lot. Now im back to mikrotik because of your video! Cheers mate.

[@BelFaRo2008]

Work of two evenings until i found your Video... Thank you very much, Sir!

[@SteveoceeCoUk]

Thank you and no worries my friend. Have a look around my "old" site www.steveocee.co.uk and also my new site miknet.co.uk for more!

[@markormesher3360]

Thank you so much for sharing this! Pulled my hair out for an hour trying to fix this and you just showed me how in a few minutes.

[@MrTVintro]

This is such an infinitely more practical solution...

[@FlexibleToast]

This video made what seems like a difficult topic if you search around the forums, very easy. Such an elegant and easy solution.

[@iqbaltiro]

Thanks for the tutorial mate, I've been scratching my head for almost a year trying to solve this :) I am used to OpenWrt and was getting bored with it, and wanted to try something else, then I chose Mikrotik. Hairpinning is the default for OpenWrt, but in Mikrotik it is completely different, you have to set it your self.

[@jvik]

This was really clever. I regret not finding this video a long time ago.

[@themorleyc]

Saved hours from all other posts with 1 line and simple understandabe explantion. Subscribed!

[@SteveoceeCoUk]

Glad it worked for you and thank you for the sub :-)

[@FinlayDaG33k]

I have been searching for this for a few hours now and didn't think something as simple as this would solve it

[@realkahlil]

Fantastic job. I wish this was in the manual. You made it so simple. Since, I already am using Duck DNS I used that and it seems to be working. Thank you for this video. I was trying so many other complicated things for no reason.

[@cosmin5766]

This tutorial saved me after 8 hours of trial and error. Thanks a lot!

[@SteveoceeCoUk]

Glad it helped

[@shahriarshojib]

OMG can't believe i wasted 1 hour trying to figure this out, Thanks for the tutorial, Very helpful. I am sure the dynamic ip forwarding will come in handy to a lot of peoples as well.

[@SteveoceeCoUk]

Glad it helped you out! Check my channel for more videos!

[@Geniuseus]

Works like a charm! Also, if you use the "address type" switch on your port forward rules and set it to "local", you don't need any magic with the "cloud" settings

[@SteveoceeCoUk]

If you activate the "local" option though that means no actual WAN traffic will match and the rule would only work for local traffic?

[@Geniuseus]

@Steveocee to be fair, I'm really a beginner regarding Mikrotik routers, so I'm not sure, but the harpinning works this way. If you'd like, I can share the relevant config parts.

[@SteveoceeCoUk]

Yes totally agree, from your LAN the hairpinning will work but it will not forward for people outside of your LAN (ie WAN port forwarding). This is because the matcher specifies a local address. My solution does not care, LAN or WAN as long as the destination IP is the WAN IP :-)

[@Anachroschism]

Your guides are very easy to follow, which I certainly appreciate. Now I just need a DMZ zone tutorial that is as easy to follow.

[@SteveoceeCoUk]

I'm glad you like them! I don't/didn't have plans for a DMZ tutorial BUT please feel free to get in touch through my website and I will sort you the right config out. It's relatively straight forwards to do!

[@anyoneoreally7996]

Amazing! Thank you, sir! I come from the Linux perspective where this is much easier, but thanks to your explanation which builds a bridge for me now I understand how to achieve it on Mikrotik router (which happens to be my ISP's choice). Respect!

[@freshgino]

This video is 100% correct. The forums and other outdated bs out there just all need to link here. You must change all your port forwarding rules to use the address list as the destination before the Hairpin NAT rule will work. The Mikrotik App defaults the port forwarding setup to use the WAN interface.

[@neelkanthgovindji1173]

Thank you a ton! this helped me figuring out the NAT Loopback issue I had.

[@rsur2000]

Thank you so much for this video. I've been looking for this. Now I can make hairpin NAT works in my network

[@SteveoceeCoUk]

Thank you for your time watching.

[@paulnolastname4298]

Spot-on, thanks. I have my no-ip updated by my NAS already so the address list trick was even easier (just use address lists to resolve the already existing ddns address). Greatly appreciated.

[@AshtonClemens]

Thank you! Using the IP address instead of the interface fixed my NAT reflection problem.

[@l4nsocrates]

finaly! THANKS, reading hours of mikrotik forum, and you got it to me in 7 minutes!

[@SteveoceeCoUk]

Annoying isn't it? I spent hours on the forums and was amazed how well this worked when I tried it out.

[@FireWallCR]

I was trying a lot of Hairpin-Rules, this was easiest I found and worked. Thanks a lot! Pura Vida!

[@SteveoceeCoUk]

Thank you for watching my video and I'm glad it worked for you!

[@CakeandCookieLP]

Goddamn, this was soooo easy. How has no one else explained this so well? Thanks, definitely subscribed!

[@SteveoceeCoUk]

Than kyou for your watch time and kind words.

[@Heckatomba]

Thank you very much for the clear explanation. Worked for me as well. Although I made one small change. Rather than using DDNS, I copied somebody else's script (found on Mikrotik forum) so the DHCP client updates the address list by itself: :if ($bound=1) do={ /ip firewall address-list set [/ip firewall address-list find where comment="wan1ip"] address=$"lease-address" disabled=no } else={ /ip firewall address-list set [/ip firewall address-list find where comment="wan1ip"] disabled=yes }

[@SteveoceeCoUk]

Thank you - This works due to the dhcp client on the WAN - the DDNS method accommodates better to pppoe but if it works it works! I’d prefer a non cloud reliant version so yours is very appealing 😂

[@coeniejvr]

THANK YOU, it worked for me by leaving in interface blank

[@generallisimus_]

Best guide I ever see on these theme. Thank you!

[@MatyasPesek]

OMG! you saved my life, I've been trying to figure it ou for a week now, thank you so much, you're awesome!

[@SteveoceeCoUk]

Thank you

[@mobiusphantom3489]

Nice video - My Unify gateway died so I hauled out an RB2011 I had lying around. (Public holiday so had to work with what I have and to be fair its a good device). The one remaining thing was accessing my web server internally - I could have just fiddled with internal DNS to point to the internal server but thats messy. This was easy and the hairpin NAT helps a lot.

[@mehmetcanakpinar1644]

Thanks a lot. I am using static ip and it helped me a lot.

[@danielessien2445]

Thank you so much ... have been on this for months

[@slabegregor]

Finally. I was struggling a lot with this one and now finally it works. Thanks mate ;)

[@richardvanorsouw9642]

Thanks mate, fixed my issue with 443 and 80 NAT

[@Refresh5406]

You just saved me hours of work, thank you!

[@dberzins]

Thank you so much for this helpful explanation!

[@marine1718]

Thank you u just saved my day with that i had a lot of problems i didnt knew that the name was harpin nat!

[@franzgreiner-stoffele8091]

Hi Steveocee, thank you so much. This helped me a great deal. This is the first time I leave a comment, but it is worth wile.

[@SteveoceeCoUk]

Hi, Thank you for your comment. It's great to know that my work does help :-)

[@russianfool]

Fantastic! Most practical case on here that fits the exact setup :)

[@realivanjx]

thanks. since i already have the ddns service from my isp i skip the cloud thing from mikrotik and all is working now. thanks

[@youbecha64]

Thanks! This solved my problems...of course I had an additional problem of having an "In. Interface" listed for my dstnat forwarded ports...once I got rid of those (to match your screen) my loopback (hairpin) started working!

[@SteveoceeCoUk]

Yes you need to make sure you don't specify an "in.interface" as otherwise you are adding un-needed matchers.

[@andreii6938]

wow! finally found this after hours of knocking my head against the keyboard! thank you!

[@SteveoceeCoUk]

Glad I could help!

[@marcetech515]

Dude!! it absofuckinglutely worked!! Thank you very much! IT saved me a lot of time and refractoring since I code, and I have been changing the url variables in order to get acces to my services hosted with the public IP! Your video got my stack working by the minute 3 of your video! Once again, thank you very mucho!! Cheers mate!

[@SteveoceeCoUk]

Thank you, glad it helped you out.

[@fujitsubo3323]

thanks dude, i used this to get it working with my static ip. i followed the wiki guide years and years ago and could not get it working becuase im dumb as dog shit, but following your guide its all working, good day to you fine sir

[@amarochemez]

Thanks very much from Argentina!

[@Anavllama]

Sweet use of firewall address lists. If someone has an existing dyndns provider they can use that in the firewall address list vice the MT cloud one (but assumes one already has a script on the router to update the dyndns provider info). The key points being one only needs hairpin nat if users are attempting to reach a server on the same LAN but using the public IP vice the more direct internal LANIP (yes seems to be a frequent requirement although seemingly strange) and that the additional hairpin srcnat rule has to be the first srcnat rule. Cheers mate Gluck iwth MikNET!!

[@ika9]

Thanks man that was a issue for me for long

[@JeanFrancoCaringi]

IT WORKED! FINALLY SOMEONE explain it well!

[@SteveoceeCoUk]

Thanks for stopping by and the comment. Check out my new site www.miknet.co.uk as I'll be adding similar awesome MikroTik tricks and tips in the near future.

[@JeanFrancoCaringi]

@@SteveoceeCoUk sure! Thanks Do you have a article/video about the use/configuration of domain names in Mikrotik?

[@FireWallCR]

The Best and to the point!. Thank you so much from Costa Rica....

[@SteveoceeCoUk]

Thank you for the watch and comment. Glad you like it and hope it helped.

[@hospitaldepcadum4760]

IT WORKS!!!!!!! THANKS i am using mikrotik and have 1 server behind it. and also a lot of lan users.

[@SteveoceeCoUk]

Glad it works for you and thank you for taking the time to let me know :-)

[@tuxillo]

If you're already updating a hostname with your dynamic IP address in a DNS service via a script (like I do), you could use that hostname for the address list too and entirely skip the cloud step. Thanks for the trick.

[@SteveoceeCoUk]

Totally correct. The "beauty" if you like of my solution is there is no scripting needed so one thing less to potentially not go wrong or one layer less of complication. Thanks for watching!

[@XOmrfloyd]

Damn, that Cloud option saved the day! THX

[@nick2k82]

Very good tips my friend. One of the best videos. Good Luck

[@aspen6393]

You're awesome! Helped me a lot!

[@brycesterproject]

This is exactly what I was looking for, thanks!

[@gabusan]

Thanks mate, it worked perfectly... Great tutorial!

[@jaspertax]

You have made my day! Thanks for this great tutorial :D

[@SteveoceeCoUk]

Glad I could help you out.

[@chillzong8754]

Sept 2021.. Works great. thanks so much for this great tutorial

[@dragos.temelie]

Thank you! Your solution worked!

[@DasFlughoernchen]

This was the information i needed! Thanks man!

[@stealthslayer90]

thank you love the dynamic ip setup part!

[@criticalmoorhen]

You are a FUCKING legend. Thanks a lot!!! You don't realise how much time I wasted on this. Thank you so much. I belive there are more people like me unsuccessfully trying to figure this out.

[@SteveoceeCoUk]

Thank you, glad I could help you out dude.

[@ausare32]

Awesome video, I had so much trouble with this!

[@lassivaatamoinen5468]

Nice one! Was just wondering about this on my 2nd evening with MikroTik NAT configuration session. Kind of had this idea but not sure how to put it into MikroTik terms

[@NomadAerial]

3:18 had me rolling! Video seemed really professional up until that point. Thanks for the laugh, brother! (And the tutorial!)

[@SteveoceeCoUk]

Thank you for the watch and the comment. Professional is not something that describes me lol.

[@NomadAerial]

@@SteveoceeCoUk There are likely to be a few people I work with who would say the same about me. I've worked in IT for nearly 30 years. I've lost all sensitivity to anyone offended by sounds that come out of my mouth when I work. Besides, I believe, "completely fucking mental" is, in fact, a technical term used to describe a packet storm or a routing loop without depth limits.

[@AthanasiosRorris]

Thank you very much, great guide and explanation.

[@pedromartinezdeaguilar9187]

Quiet dificult to make it easier, thanks

[@manhle-er3ov]

thanks, it really works, saved me alot of time - ALOT

[@SteveoceeCoUk]

You're welcome!

[@stevecole3079]

Great job Steve, thank you

[@heathcoleman8848]

Thank Exactly what i was after

[@MrZeynelyenici]

I also Truly appreciate your Tip !

[@tomekhekin914]

Thank you I am using your tutorial for 2 time

[@AndreasHanfelt]

This was really great thank you so much!

[@alanfaur1]

steve thanks for the video Works fine!

[@Fadeevator]

Friend of mine gives me another solution: Static DNS. Name is your ddns, ip is your HASS ip. It still need to be used with default port in local network (like 8123), but works like a charm, simple and quick. Also you need to do ipconfig \flushdns on your computers that you previously connect to HASS.

[@SteveoceeCoUk]

How does that work on devices you can't enter static DNS like mobiles? My solution works network wide no matter what device 👍 No static entries needed.

[@Fadeevator]

@@SteveoceeCoUk sorry, my explanation was bad. I did a static dns on mikrotik, so any device that locally adresses to ddns goes straight back to local ip of my hass.

[@Fadeevator]

And one simple dstnat port forward like one on your video for external clients.

[@ydimitrushev]

You my man are a God!

[@SteveoceeCoUk]

Not at all. I came across a common problem and tried to find the simplest solution that would work in every scenario.

[@ydimitrushev]

@@SteveoceeCoUk I really appreciate your time. Thank you! There are so many ways to do bad config on this powerful router/os so your explanation saved me a lot of resetting :)

[@SxMT]

Sweet, very clean. I like it

[@EndureTemptation]

I was trying to set up my Minecraft server. I expected there to be a checkbox in Router interface that says: "Enable NAT loopback". Anything more than that doesn't help me. What I'll do is just ignore the problem. Thanks for trying to help!

[@GlynnRyan]

Thanks, this worked for me!! Something I ended up doing instead, to access the applications running on my server located on my LAN (accessed by port forwarding on my dynDNS), was by assigning my dynDNS as a static DNS and pointing the dynDNS to my LAN IP. For Example: /ip dns static add address=10.0.0.666 name=my-dyndns.org This allows me to access my server applications with the same bookmarks and addresses saved for access from outside my network. Accessing the same application from outside the network works without issue. :-)

[@SteveoceeCoUk]

Just goes to show that with networking there is never a right way or wrong way of doing things, but there is always a way! I will caveat though that doing it the way I have done you don't involve a 3rd party such as dynDNS which by itself needs a script running within a MikroTik to update it, at least the IP>Cloud mynetname is native to it. I'd just rather rely on less external factors.

[@GlynnRyan]

Steveocee definitely agree with you! I already had my dynDNS configured and setup prior to investing in my RB3011 and struggled for months to find a working solution until I found yours. In the process, it got me thinking, which resulted in going the route I did. Thanks again for the vids mate!

[@isaacgrover]

Thumbs up if you came here from the Mikrotik forums - thanks Steve!

[@rimasxxl]

Great, it works!

[@trixiglk]

Only this one option (from this film) working with my mikrotik.

[@EitanRooz]

Thank you for explaining😀

[@ultimatetian]

Very helpful!

[@SteveoceeCoUk]

Thank you