Manual

Opening a port

Reaching a device inside from the outside, and when you had better not.

A port forward tells the router: when traffic arrives from outside on this port, send it to this device in my network. In RouterOS that is a dst-nat rule. You need it for a web server, a game server or a camera that has to be reachable from outside. You usually do not need it when only you have to get in: that is what a VPN is for.

Where it sits

In the Firewall & NAT section, under Port forwarding. The router roles show the same list in the wizard as well.

The fields

  • Protocol: TCP, UDP or both. Both writes two rules.
  • External port(s): what gets knocked on from outside. A list is fine: 80,443.
  • To internal address: the fixed address of the device inside.
  • Internal port: optional. Leaving it empty means the same port as outside. Fill it in and 443 from outside arrives on 8443 inside, for example.
  • Comment: ends up as a comment in the script and helps you a year from now.

Give the device inside a fixed address, or your rule points at the neighbour after a reboot. In LAN and DHCP you set a fixed lease on its MAC address for that.

Restricting who may get in

The forward row itself has no field for the source address: it is open to the whole internet. To narrow it there are two routes in the tool. Put the allowed addresses in an address list and add a custom filter rule in the forward chain that drops traffic to the internal address except from that list (RouterOS accepts an exclamation mark in front of the list name). Or, if the service runs on the router itself rather than on a device behind it, use the services on the router reachable from the internet list: that one does have an only from field.

Mind the difference between those two lists. A port forward goes to a device behind the router. The second list opens a port on the router itself, for a service you run there. VPN ports belong in neither: those are added automatically from the VPN section.

Hairpin NAT

Without hairpin your forward works from outside, but not when you try the same public address from your own sofa. That is the classic "it works on mobile data but not on Wi-Fi". With hairpin NAT on (the default as soon as there is a forward in the list) you get a second dst-nat rule for traffic from the LAN towards an address of the router itself, plus a masquerade rule so the reply comes back through the router instead of directly. That masquerade half uses the range from LAN and DHCP.

Hairpin is not the only answer and usually not the prettiest one. A static DNS record that points the name to the internal address from inside is cheaper and more honest. See DNS.

What the configurator makes of it

One rule per forward in /ip firewall nat, chain dstnat, with in-interface-list=WAN. The default forward rule that drops everything from WAN deliberately lets dstnatted connections through, so you do not need an extra accept rule. That is exactly why the closing rule is called drop all from WAN not DSTNATed.

Why double NAT breaks it

If your ISP's modem is still routing, your router has no public address but one from the modem's network. Traffic from outside then never reaches your rule, because the modem does not know where to send it. Check what address your WAN port has with /ip address print. If it starts with 192.168., 10. or 100.64., you are behind something.

  • Put the modem in bridge. That is the real fix; your router then gets the public address.
  • If you cannot, you have to forward in the modem as well, to the WAN address of your MikroTik. Two layers that both have to be right.
  • If your ISP no longer gives you a public address at all (CGNAT, the 100.64.0.0/10 range), there is nothing to forward. Ask for a public IPv4 address, use IPv6, or have the connection set up from the inside with a VPN.

The safer route: a VPN

Every open port is a door the whole world may lean on. If only you need to reach your NAS, your cameras or your server, do not open a port but set up a WireGuard tunnel. You are then inside as if you were at home, and from outside there is nothing to see. The tool warns about this actively for ports 3389, 445, 23 and 21: remote desktop, file sharing, telnet and FTP do not belong straight on the internet. See VPN for the road.

When it does not work

  • Test from outside, not from inside. Use your phone on mobile data. Testing from your own network tests hairpin, not your forward.
  • Is the rule there? /ip firewall nat print stats shows whether packets hit your dstnat rule. Zero means it never even reaches the router, so look at the modem or your ISP.
  • Does the device inside have a firewall of its own? Windows, a NAS and many cameras block anything from outside their own subnet by default.
  • Is the internal address still right? Without a fixed lease it moves.
  • Does your public address change? Then you need a name that follows it. You arrange that with your DNS provider or with the RouterOS cloud feature, not in this section.

Further reading: Firewall and NAT, Recipe: a server reachable from the internet and When something goes wrong.

Want to try it right away? Open the configurator