Port Forwarding on MikroTik
Port forwarding is a network configuration technique that directs incoming traffic on a specific port to a particular internal IP address and port on a local network. This is useful for services like web servers, game servers, or remote desktop access, where external users need to access devices or services within a private local network (LAN) from the internet.
In MikroTik routers, port forwarding is typically configured using NAT (Network Address Translation) rules. These rules are added in the MikroTik firewall to control how incoming packets are handled and forwarded to the appropriate devices inside the network.
When to Use Port Forwarding
Port forwarding is required in the following scenarios:
- Accessing a web server, FTP server, or game server located in your local network from the internet.
- Using remote desktop applications to access a device in the internal network.
- Enabling access to specific applications or services (e.g., surveillance cameras, email servers) on the local network from remote locations.
- Running a VoIP service or similar applications that need to be accessible externally.
How Port Forwarding Works
When an external device (e.g., a remote user) sends a request to your public IP address on a specific port (e.g., HTTP on port 80), the router checks its NAT table for the appropriate forwarding rule. If a matching rule is found, the router will forward that request to the specified internal IP address and port within the local network.
For example:
- You may have a web server running on an internal computer with IP
192.168.1.100 on port 80 (HTTP). - A port forwarding rule is set on the router to forward any external requests on port
80 to this internal IP address.
Setting Up Port Forwarding on MikroTik Router
Follow these steps to configure port forwarding on a MikroTik router using the WinBox interface or WebFig (the web interface).
Step 1: Identify the Port and Service
Determine which service you want to forward and what port it uses. Common services and ports include:
- HTTP (web servers) – Port 80
- HTTPS (secure web servers) – Port 443
- FTP (file transfer) – Port 21
- SSH (secure shell) – Port 22
- RDP (Remote Desktop Protocol) – Port 3389
- Game servers – Specific game ports (varies by game)
Step 2: Create the Port Forwarding Rule in MikroTik
Log into your MikroTik router using WinBox, WebFig, or SSH.
Go to the NAT settings:
- In WinBox/WebFig, navigate to IP → Firewall → NAT.
Add a new NAT rule:
- Click on the + button to add a new rule.
- In the General tab:
- Chain: Set this to dstnat (destination NAT).
- Protocol: Choose the protocol (e.g.,
tcp for web traffic). - Dst. Port: Enter the external port that you want to forward (e.g.,
80 for HTTP).
Set the action to forward:
- In the Action tab, choose dst-nat (Destination NAT).
- To Addresses: Enter the internal IP address of the device you want the port to be forwarded to (e.g.,
192.168.1.100). - To Ports: Enter the internal port number (often the same as the external port, e.g.,
80 for a web server).
Save the rule by clicking OK.
Example: Forward HTTP (Port 80) to a Web Server
You want to forward HTTP traffic (port 80) to a web server with the internal IP address 192.168.1.100 running on port 80.
Configure the following in MikroTik:
- Chain:
dstnat - Protocol:
tcp - Dst. Port:
80 - To Addresses:
192.168.1.100 - To Ports:
80
This rule will forward any incoming traffic on port 80 (HTTP) to the internal server at IP 192.168.1.100 on the same port.
Step 3: Ensure Firewall Rules Allow the Connection
Make sure that the firewall on the MikroTik router allows incoming traffic on the forwarded port.
- Go to IP → Firewall → Filter Rules.
- Ensure there’s a rule allowing incoming traffic on the forwarded port (e.g., port
80 for HTTP). - If necessary, add a rule to allow the traffic from the outside:
- Chain:
input - Protocol:
tcp - Dst. Port:
80 - Action:
accept
Step 4: Test the Port Forwarding
External Test: From an external network (e.g., using a mobile device or an external computer), try to access your public IP address followed by the forwarded port. For example:
http://<your-public-ip>:80- If it’s a web server, it should open the web page hosted on the internal server.
Internal Test: You can also test by accessing the internal server from another device on the local network using the local IP address directly.
Advanced Port Forwarding Configuration
Port Forwarding with Specific Source IP: If you only want to allow port forwarding from certain IPs (e.g., a specific external user or trusted network), you can add a condition for the source IP:
- In the General tab of the NAT rule, set Src. Address to the IP address that should be allowed to initiate the connection.
Multiple Services: If you need to forward multiple ports for different services, you can create multiple NAT rules (one for each port) or use a range of ports.
Port Forwarding for a Range: If you need to forward a range of ports (e.g., for a game server), you can specify a range in the Dst. Port field:
- Dst. Port:
5000-5050 for a range of ports.
1:1 NAT (for multiple services on a single IP): If you want to map a set of ports directly to a particular internal server, this can be done using 1:1 NAT, which ensures the public IP is directly mapped to a local IP.
Security Considerations
- Limit Access: Be cautious when exposing services to the internet, especially those that may be vulnerable (e.g., RDP, SSH). Always use strong passwords, and consider limiting access to known IP addresses where possible.
- Firewall Configuration: Always ensure your MikroTik firewall is properly configured to only allow necessary traffic.
- Port Scanning: Be aware that port scanning tools can expose open ports. Only forward ports you really need.
Conclusion
Port forwarding on a MikroTik router is an essential technique to allow external devices to access services inside a private network. It can be used to expose web servers, FTP servers, or other services securely to the internet, but it’s crucial to configure it correctly and ensure that only authorized traffic is allowed.
