26 September 2013

Mikrotik NAT, access services via external IP from inside the network

The laptop at wants to communicate with the web server on via the external IP address of the Mikrotik router at

Say you have a service such as webmail, which has a nat rule to allow access from an external network...

/ip firewall nat add chain=dstnat action=dst-nat dst-address= protocol=tcp dst-port=888 to-port=80 to-address=

This works fine of course, so users set up the shortcut to

Problem is when they are on the internal network it doesn't work, because the Mikrotik router won't send the reply data back out the same interface. A work-around is to create a src-nat rule directly below the dst-nat rule like this.

/ip firewall nat add chain=srcnat action=masquerade src-address= dst-address=

Goes something like this..

1. Client initiates http request to
2. MT receives and translates destination to as per 1st rule
3. MT then translates the src address from to as per 2nd rule
4. Now communication appears to be between and

Happy days.

No comments:

Post a Comment