Port Forwarding Step by Step - Mikrotik Tutorial

Port Forwarding Step by Step using Mikrotik RouterOS
Learn how to easily provide access to internal resources using private IP addresses by using destination NAT (dst-nat)
You'll learn how to configure Mikrotik devices using the GUI (Winbox) an CLI (Command Line Interface).
CLI Command
/ip firewall nat
add action=dst-nat chain=dstnat dst-address=PUBLIC-IP dst-port=PUBLIC-PORT protocol=tcp to-addresses=INTERNAL-IP to-ports=INTERNAL-PORT
Install Mikrotik on GNS3 - Network Simulator
• Install GNS3 VM + Mikr...

[@CJ.-_]

Great video on port forwarding with mikrotik routerOS. Other videos showed what to do, but didn't show the why or how. You are a natural teacher great job!

[@TheNetworkTrip]

Great to hear!

[@mohammedalfathali6202]

nice man i was at work and you saved my day.

[@nicolasvelasco4162]

Great explanation and very handy... it is not easy to understand the dstnat concept with the IP's and so. I was able to finally configure my Mikrotik, which is after an ISP router to forward ports to internal machines. Many thanks

[@TheNetworkTrip]

Great to hear!

[@MitchRSA]

You are a great teacher. Thank you.

[@TheNetworkTrip]

I appreciate that!

[@juanferley]

Great video and you explained each step pretty well.

[@TheNetworkTrip]

Glad you enjoyed it!

[@JasonsLabVideos]

Agreed 100%

[@MrErsoyyilmaz]

Finally.. After many many explanations..Thanks you, now ok.

[@TheNetworkTrip]

Thank you

[@MrErsoyyilmaz]

@@TheNetworkTrip Really I watcheid many many and many lections about NAT, You made the point. Very clear and funtionally. Thanks again.

[@colokwing6260]

Thanks, worked wonderfully

[@TheNetworkTrip]

Great to hear!

[@Red1Wollip]

Thank You for opening my eyes to understanding Port Forwarding. That was a simple explanition of the subject and I appreciate it very much.

[@TheNetworkTrip]

Thank you Dennis. Glad to hear that.

[@tallyharry3704]

I really would love to know more about firewalling. Thanks sir

[@socrateslaskaridis1144]

great video, i setup vpn in 5 minutes, thanks.

[@abe1p6]

thank you, great videos

[@TheNetworkTrip]

So nice of you

[@stenbrunnstrom8087]

Very good explanation

[@TheNetworkTrip]

Thanks and welcome

[@Ervinof]

Great video thank's

[@TheNetworkTrip]

Glad you enjoyed it

[@DarleyDBC]

tks, very usuful!!!

[@salisumar3300]

Wow!!! Great !!! Thank you very much for the knowledge shared and taking your time to explain it simple, easy and understandable way.

[@TheNetworkTrip]

Glad it was helpful!

[@hudratore]

thanks a lot !!

[@SergeantTrigger]

thanks!

[@jellyCLASH]

You are my superstar!!!!!!

[@TheNetworkTrip]

Thank you!! It's a pleasure

[@fahimrahman5909]

great tutorial. can you please make a tutorial on how to use 2 internet connections using mikrotik router?

[@stevelugoma]

merci beaucoup

[@ezequielzanardi687]

Excelent!! Thanks, worked fine for me. Do you have an idea how to do dst NAT with a public address different to the WAN address but in the same subnet?

[@KidsShowtimeOfficial]

How make the public IP address as static? In other router when you set the port forwarding why it use Mac address rather than IP? For example I have biometric device and i make port forwarding using the Mac address of the device but why I can't connect outside the network?

[@demotictechnologiespvt.ltd3419]

Hi sir, Thanks for the video, Here, We forwarded port 80 on local IP address,, which means 80 port is open for that particular on that particular private IP, "Is it possible? for the public IP addresses, where we can allow a single port and other ports denied"

[@tallyharry3704]

Thank you sir, Please when can we get a video for Hotspot and userman? Thank you and God bless you real good.

[@constructionwolf]

What field do I specify if I want to lock the port forwarding so it only works from 1 specific address - in my case I want to only allow port forwarding for port 5060 FROM my ITSP IP address. Does that go in the Source IP?

[@TheNetworkTrip]

Hi, you're right!! You can add one more condition: src-address=ALLOWED_IP to satisfy your requirement.

[@intonations]

great help you doing here .. thank you how you put real static ip in this lab in your browser lab ?? how can i do the same in my gns3 vm ? if i want to apply this lab

[@kogh55]

Helllo. Great videos. What software do you use for diagrams? You can recommend some topoly drawing software?

[@TheNetworkTrip]

Hi, thank you. I used Eve-NG in this tutorial.

[@aimn19861]

@@TheNetworkTrip is it paid?

[@point25percent]

my + is not blue so I can't click on it. when you click on ip and then on firewall. the + for add is not coloured like yours how do i change that

[@tahasiddiqi3689]

HI i have a problem i have sip phone and when i conntact with our server microtik cant allow port or firewall to register our ip phone

[@d0muks]

I need to do udp and tcp port forwarding and it doesn't work cant you help?

[@davidperdomo9]

Excelente video Wilmer! me funciona en mi navegador, pero si intento desde otra red no ingresa, probe desactivando todas las reglas de firewall, que me puede estar faltando?

[@salembaabbad8783]

Great video, but what if i have two internal servers how to forward to the second server

[@TheNetworkTrip]

Hello! You can use a different external port. The internal port can be the same.

[@salembaabbad8783]

@@TheNetworkTrip thank you sir

[@NeerajLalu]

does the forward chain firewall rule not affect the Nat rule this will only work if ther are no Forwarding rules

[@TheNetworkTrip]

Hi! This will work if there are no rules blocking in the forward chain. By default, there aren’t. It should work.

[@lnx5232]

Hello, great video, this rules working with another port but i test port forwarding to internal web server running in to 443 port (ssl) and not working, can you add fix solution for this case?, thank you !!!

[@ronaldhaley6169]

Still waiting for your L3 hardware offloading video:)

[@TheNetworkTrip]

Hello, I’m sorry for being out for so long

[@FlexibleToast]

This works great for external traffic, but it doesn't work from LAN. From my understanding I need a hairpin NAT for that and I can't seem to figure out how to get it to work.

[@TheNetworkTrip]

Hi Joseph, I will create a video explaining Hairpin NAT. Thank you for the suggestion

[@aimn19861]

What if Mikrotik Rb2011 is behind ADSL router and there's other RB1100 also Behind Rb2011 ,i succussed forward traffic from ADSL Router to RB2011(Using Mikrotik Cloud) but can't do that to RB1100

[@pizzahut9691]

I did mine using different port numbers but it did not work only port 80 works what could be the reason

[@TheNetworkTrip]

Hi, thank you for your comment You can use /ip firewall nat add chain=dstnat action=dst-nat dst-address=PUBLIC_IP dst-port=PUBLIC_PORT to-addresses=INTERNAL_IP to-ports=INTERNAL_PORT protocol=udp_or_tcp Good luck!

[@dhruvpatel1914]

If i have two web server with two different private IP address how to configure them.for access on internet

[@TheNetworkTrip]

Hi Dhruv, thank you for your comment! If there are two or more internal devices, and the border router only has one public IP, then you can have one rule per internal device, and the public port can be different. For example: You can use 80, 8080,8081,8082, and so on and so forth. PublicIP:8080 -> 192.168.X.Y:80 PublicIP:8081 -> 192.168.X.Z:80 I hope that can help you.

[@haroldcrisdayritabarquez7795]

this works when you are accessing from outside your network. It does not work when you visit the public ip from inside your network. You need to configure hairpin nat.

[@TheNetworkTrip]

Hi Harold, Hairpin Nat will allow access from the internal network. Great!

[@MilanKarakas]

I am very confused here. Your Gateway is 190.10.0.1, but what is an internet IP? I have problem because my router is TP-link going over MikroTik to the internet. Do I need port forward only one or both? Thanks.

[@TheNetworkTrip]

Hi Milan, You will require port-forwarding or DMZ in any additional router between the public IP and the internal resource.

[@MilanKarakas]

@@TheNetworkTrip Okay, on TP-Link (first to the PC and Raspberry PI is that one) there is two option: forwarding, but unable to set port 80, and DMZ. On MikroTik, there is very complicated situation. This router is connection to my ISP, because no way to have high speed internet. On MikroTik (5 GHz), there is too much thing to configure, but unable to find port forwarding or DMZ.

[@bhartendulal8645]

HI SIr, I watch your video, Great explanation, Please make a video for install Mikrotik os in gns3, i installed mik os in gns3 but when ever, i am going to add 2 or more port with that, then connect to each other not going ping each other,,, But when i do not add any port with that and connect two router with default port, and configure ip , both router is going to ping , Please guide..

[@TheNetworkTrip]

Hi Bhartendu, thank you for your comment. I will create a video for GNS3 and Eve-NG step by step.

[@TheNetworkTrip]

kzbin.info/www/bejne/iHrXZ3RurbJjjNk

[@tuqueninja7886]

Hello and excellent video! I'm having a problem though. My modem is set to bridge mode with 1 IP address going to a router for my home network and the 2nd IP address going to my Mikrotik hEX S for my server, running on a Raspberry Pi4. I followed your steps but when I run telnet 80 it always comes back with "Could not open connection to the host, on port 80: Connect failed" Port Forwarding for port 22 for SSH works no problem, but for port 80 it always comes back closed from an outside network. Have you any help for me? Thank you so much :)

[@TheNetworkTrip]

Hi Graham, thank you!! It seems port 80 is used by another service (the webfig in the hex maybe?). I would suggest to change the www port on the Hex to a different value, and then it should work is everything is configure similar to the SSH port. I hope this can solve your issue.

[@tuqueninja7886]

@@TheNetworkTrip thank you for your quick reply. That makes sense. That would be "IP" -> "Services" and changed WWW port to 84 . When I run nmap -p 80 instead of state "closed" I am getting state "filtered" Any idea on that my friend?

[@TheNetworkTrip]

It seems like that is a firewall blocking somewhere, any rules on the forward chain blocking port 80?

[@tuqueninja7886]

@@TheNetworkTrip not that I can see. Just to test, I disabled all the filter rules and ran nmap again on port 80 and it is closed. Also check the Ubuntu Firewall and it is disabled. Port 22 for example, no problem, open and good. But Port 53, 80, 123 always closed

[@junaidkamal]

What to do if i have 14 live static IP and i want to forward my local ip to static IP no 12?

[@TheNetworkTrip]

Hi Junaid, You need NAT 1:1 to accomplish that. I'll create a short video explaining that process.

[@junaidkamal]

@@TheNetworkTrip i will be thankful ♥️

[@Anavllama]

Very basic instructions with lots of assumptions the reader is not aware about, not an end to end solution but nice example of one case of limited and simple dst-nat config entry

[@TheNetworkTrip]

Hello Alex, This channel is intended for basic Mikrotik configs. NAT is not an end-to-end solution. If you need that, simply assign a public IP or use Ipv6.

[@ronaldhaley6169]

You could talk about hairpin NAT here

[@TheNetworkTrip]

Hi Ronald, I will add something talking about Hairpin NAT, thank you for the suggestion

[@irtibatkisileri222]

disliked due to intro and outgo musics. content also not much helpful.

[@TheNetworkTrip]

Awesome, thank you!! Plenty options on KZbin, I appreciate your time for giving feedback