port mapping mikrotik

Space shortcuts

Troubleshooting articles
How-to articles
A t tachments (9)
Page History
Page Information
Resolved comments
View in Hierarchy
View Source
Export to PDF
Export to Word

Port forwarding

To redirect specific requests to a specific address on the internal network, use dst-nat, follow the steps below:

This established rule can be translated as follows: When an incoming connection with the TCP protocol requests port 80, translate the recipient's address and redirect it to the local address 192.168.1.1 and port 80.

Follow MonoVM on social networks and stay updated with our new posts.

Mikrotik Port Forwarding - RouterOS Port Forwarding

This tutorial will help you with How To do Mikrotik Port Forwarding and give you a step-by-step guide on the port forwarding Mikrotik command.

List of content you will read in this article:

MikroTik RouterOS is the stand-alone Linux operating system that is used with MikroTik’s networking equipment. However, that is not the only function it can perform. It is more than just an OS for routers. In fact, this software can even be installed on regular PCs to turn them into dedicated routers.

Nevertheless, the blog is a step-by-step tutorial on how to configure port forwarding in MikroTik. Before we get into it, however, we will first discuss a little more about the OS itself and give you a general idea of what port forwarding id & Mikrotik port Forwarding, and RouterOS Port Forwarding actually is.

Mikrotik Port Forwarding

I’m Oliver k. I have MS degree in Computer Engineering . For nearly 5 years that I have been working on web programing and also in last 2 years I have worked on windows and Linux VPS. This is my honor to share my experiences with a new community.

2019, Nov, 19

I don't understand which devices (10.10.10.10), (10.10.10.10:5847) and (20.20.20.20:4324) are supposed to be.

2020, Jul, 20

The 10.10.10.10 is your WAN IP. It is the IP of your router as the internet sees it. 20.20.20.20 is the IP that you want to forward your traffic to. Late reply, but should help those that are wondering the same and came to the comments for help

2020, Jan, 20

Hi Oliver, good day can i check with you how to setup a simple port forward in MT router for an ovpn server? I did try your setup but it did not really work and I notice that I only have my nas ip. do i need to put my router lan ip or wan ip liek you 10.10.10.10? my ovpn server is running from my nas. i have try a few setting but it cannot connect. i can see that my iphone is hitting my MT router Nat rule but always fail to connect. Thanks my setting General tab Chain: dstnat Protocal : udp dst port: 1194 Extra tab Address Type: local Action tab action: dst-nat to addresses: ovpn ip

2020, Feb, 20

Hi Oliver, Thanks in advance for any assistance you can offer to port forward my Mikrotik router so I can access a couple IP cameras from the internet when away from my LAN. I have setup a free DDNS account with NO-IP if needed, and have static IP's in each camera. I've had success in setting up a NAT rule in the past, but having issues any attempt after I moved. Dennis

2020, May, 20

Hey, thanks for the clear guide. I have a dynamic wan ip, but I'm connecting via a dyndns domain (example.dyndns.org). I leave my dst adress in blank but in canyouseemee it says "connection refused" I'm able to acces via the dyndns domain locally, nut when I try that outside of my lan, I can't access.

2020, Jun, 20

Hello Gab, I did it same way as you, left dst address blank and it worked. Just had to add both tcp and udp.

Thx for tutorial.

2020, Aug, 20

Great tutorial. I would just like to know would this work for my PS4 as well? I'd like to forward port for PS4 and have an open NAT type.

Hi Oliver,I want to forward an IP range in MikroTik (16384-32768 with UDP protocol).How can I do this?

ELIUD MUNENE

2020, Nov, 20

I have read your tutorial. I have been trying to connect php mixbill to my router without success. Kindly let me know whether this process will be successful. Thank you.

How to port forwarding for ftp ,? Help me please

2021, Jul, 21

I would say Mikrotiks works stable, but configuring them its one of a hell. Probably most complicated routers...

Download PDF

Set up Port Forwarding on Mikrotik Router

This topic provides a configuration example of port forwarding on Mikrotik router.

Configuring MikroTik port forwarding through Winbox

October 25, 2022 by Liosa F

MikroTik RouterOS is a powerful Linux-independent operating system designed to interact with MikroTik network equipment. MikroTik RouterOS is more than a simple router operating system and has many functions and applications. This software is capable of turning it into dedicated routers by running on a normal and personal computer.

Port Forwarding or Port Mapping is a NAT program used in MikroTik to redirect traffic from an IP address and port number on a remote network to an IP address and port number on a local network. In other words, Port Forwarding is the most secure way to connect to your servers from outside your local network without risking network security.

Using MikroTik port forwarding, you can easily connect from outside your private/local zone (from the internet/public) to a server in your private/local zone, such as web server, game server, FTP server, and NVR and DVR.

If you have servers and applications on a private network that you need to access over the Internet and public networks, the best way to log into MikroTik RouterOS is through Winbox. Configuring Mikrotik port forwarding is very simple. In this article, we will introduce you to Port Forwarding in Mikrotik and teach you how to configure port forwarding in the Mikrotik router step.

Before starting the port forwarding configuration process in Mikrotik, we will briefly introduce the Mikrotik operating system and a definition of Port forwarding. Stay with us until the end of the article.

What is Mikrotik?

MikroTik is a hardware and network equipment manufacturer in Latvia that is the main provider of Internet access infrastructure (hardware and software) in most countries. They design and market hardware and software for computer networks, including routers, switches, access points, utility software, and operating systems.

RouterOS is the operating system used by MikroTik. MikroTik provides a lot of freedom to manage networks with its advanced router. Installing RouterOS on a PC turns the device into a fully functional router with features such as routing, firewall, bandwidth control, wireless access point, backhaul link, hotspot gateway, VPN server, and more. In order to provide automatic operation, the boot time can be reduced by using Mikrotik, a very effective router.

What is port forwarding?

Port forwarding refers to the technique of routing data traffic on a network that is usually directed to a specific IP address and port on a particular computer and then to a new destination. A MikroTik router or any other device running RouterOS makes this process easier. Therefore, assigning a specific port to a specific service in the private network makes it possible to use that specific service for another user by entering that port in their browser or software.

Mikrotik is placed as a router between the internal path of your private network and the public network (Internet). For example, suppose you have a site inside the organization with a specific port. In that case, if you are thinking of outsourcing your IP address or domain with a port to the software inside the organization, you should use port forwarding.

Imagine that you are the IT manager of an extensive network looking for a safe, low-risk method for network security to allow someone to remotely access your VPS on your network while you don’t want to share the server’s IP with that remote person. In this situation, port forwarding in the Mikrotik router is the safest solution to solve your problem, which provides the possibility of connecting to the VPS in the local network for people outside your private network through the port. For this, you need to buy the desired Mikrotik VPS first so that you can benefit from Mikrotik Port forwarding.

Network diagram

The ether1 interface of the MikroTik router in this network is connected to a wide area network (WAN) with IP address120.50.–.198, while the ether2 interface is connected to a LAN switch with IP address193.168.20. Only those on the local area network (LAN) can access the three servers (web server, FTP server, and SSH server) located on the internal network. By using MikroTik Port Forwarding, you can make these servers available to users outside your local network; we will teach how to configure MikroTik Port Forwarding to connect to servers inside the local network through the Internet for users outside the local network.

How to configure Mikrotik Port forwarding

Mikrotik Port forwarding is a widely used method to respond to various purposes, which are considered three common purposes in our training:

Configuring MikroTik port forwarding to the internal Web server through Winbox

To go through the port forwarding steps, note that you have installed the latest version of MikroTik RouterOS.

To provide access to a web server inside the internal network from outside the internal network, we provided the following steps to configure MikroTik Port Forwarding to connect from the public network to a specific web server with Ip Address (193.168.20.10) according to the network diagram as an example.

Step 1 : Log in to the Mikrotik server using Winbox as a server administrator with the required permissions

Step 2 : Click on IP on the left side of the panel

Step 3 : In the opened menu, select Firewall .

Step 4 : In the Firewall window, click on the NAT tab.

Step 5 : The NAT Rule window will appear by clicking on the PLUS (+) sign.

Step 6 : By clicking on the General tab, the Chain drop-down menu will open; select the dstnat option from the list you see.

Step 7 : Type the MikroTik WAN IP Address (120.50.–.198) in the Dst. Address input field. (Enter the IP Address from which you intend to forward all requests.)

Step 8 : Click on the TCP connection protocol from the Protocol drop-down menu.

Step 9 : In the Dst Port field, enter the port from which you decide to forward requests. Usually, the number 80 is entered in the Dst Port field because web servers run on TCP port 80.

Step 10 : Now go to the Action tab.

Step 11 : Select the dst-nat option from the Action drop-down list.

Step 12 : In the To Addresses input field, enter the desired web server IP to which you want requests to be forwarded.

Step 13 : Enter the port to which all requests are forwarded in the To Ports field . (You can type the number 80 in the To Ports field.)

Step 14 : To confirm and save the information we entered, click Apply and then Ok .

Finally, the port forwarding configuration to the internal web server has been completed successfully. Now you can access the web server by sharing the MikroTik WAN IP in web browsers outside your local network. If you want to add new rules to port forwarding, you can add new ports or IPs by going through the steps we explained.

Configuring Mikrotik port Forwarding to the Internal FTP server through Winbox

FTP(file transfer protocol) server is used to share files through client and server programs. You can also use port forwarding to create Nat rules allowing Internet users to access your FTP server. This configuration method is for the situation the FTP server is set in our local network, and we intend to provide access to the FTP server from the public network through the Mikrotik port forwarding configuration.

For this purpose, follow the steps we will explain to reach your goal.

Step 1 : Log in to the Mikrotik router via Winbox as a server administrator.

Step 2 : In the left part of the panel, by clicking on IP, select Firewall in the IP menu list.

Step 3 : In the Firewall window, open the NAT tab.

Step 4 : Create a New NAT Rule by clicking the PLUS (+) sign.

Step 5 : Click on the General option, and from the chain drop-down menu, click on dstnat.

Step 6 : In the input field Dst. Address, Enter MikroTik WAN IP (120.50.–.198).

Step 7 : To send the protocol packets, you need to continue configuration by selecting the Protocol option and selecting TCP from Protocol drop-down list.

Step 8 : In the Dst Port field, you must enter the port to which they will be connected from the public network. You can specify a port according to the server type and forward it, but FTP Server usually works on TCP port 21, so put the number 21 in this field.

Step 9 : Select the Action tab and set it to the dst-nat option.

Step 10 : In the To Addresses field, enter the IP of the FTP server inside the network (193.168.20.20.20).

Step 11 : Fill the To port field with the port of the internal server to which we want to transfer requests and traffic. (You can enter the number 21 in this field)

Note : The input and output ports can be the same or different.

Step 12 : To confirm the new rules, select apply and then OK.

The process of configuring port forwarding to your internal network’s FTP server has been completed. Now you can connect to the internal network FTP server from the Internet by entering ftp://mikrotik-wan-ip (ftp:// 120.50.–.198) in FTP clients or any web browser.

Note : Don’t forget to allow FTP service or TCP port 21 in your FTP server firewall to connect to the FTP server from the public network.

Configuring Mikrotik port Forwarding to Internal SSH server through Winbox

This is how to configure Mikrotik port forwarding to connect to the SSH server in the internal network through the public network. To do this, follow the steps below:

Step 1 : Log in to the Mikrotik server through Winbox with administrative privileges

Step 2 : By referring to the IP option on the left side of the panel, select Firewall from the IP menu.

Step 3 : Click the NAT tab in the Firewall window.

Step 4 : Open the New NAT Rule window by clicking the PLUS sign (+).

Step 5 : By selecting the General tab, select the dstnat option in the Chain drop-down menu.

Step 6 : Enter the MikroTik WAN IP address in our network diagram (120.50.–.198) in the Dst address section.

Step 7 : By selecting the protocol option to send packets from the Protocol list, click on the TCP option.

Step 8 : Fill the Dst Port input field with the port from which you intend to transfer requests. Usually, TCP port 22 is chosen to run the SSH server, so enter the number 22 in the Dst Port field.

Step 9 : Now go to the Action tab and select the dst-nat option from the Action list.

Step 10 : In the To Addresses field, enter the SSH Server IP (193.168.20.20.21).

Step 11 : Complete the To Ports field with port 22 .

Step 12 : Finally, press the Apply and Ok buttons to confirm.

Finally, you were able to configure Mikrotik port Forwarding to the Internal SSH server successfully, and if you followed the steps correctly, you can now connect to your internal SSH server through any SSH client (Putty or SSH Secure Shell Client) from the Internet.

Note : For communicating with the SSH server from the public network, it is necessary to allow the SSH service or TCP port 22 in the firewall of the SSH server.

How can we configure my Winbox to open ports?

Make a new rule by selecting the NAT tab from the Firewall menu. The rule has to be added to the DST-NAT chain.

What is the difference between Port Forwarding and Dst NAT?

There is no difference in how they work, Port Forwarding is actually the same process as Destination NAT in a Mikrotik router.

What is the default port of Mikrotik Winbox?

Winbox can be run with default port 8291. If you customize a port for Winbox management, you must enter the specified port to run Winbox. The best way to increase security is to log in with IP and enter a password and username.

What is the reason for the port being closed after forwarding?

After port forwarding, the port may be closed for various reasons, such as IP misconfiguration, simultaneous router connections, or firewall settings blocking the port. To solve this problem, when using more than one router in a network, all incoming data should be routed from router 1 to router 2.

Configuring Mikrotik Port forwarding through Winbox for the web server, FTP server, and SSH server has the same basic steps. Their difference is in entering the IP address for the To Addresses and Dst Address sections and their ports. You can use the ports you specified or the commonly used ports for web servers, usually TCP80 port, for FTP server, TCP21 port, and for SSH Server, TCP22 port.

We hope that by reading this article, you will be more familiar with Mikrotik’s port forwarding function and you will be able to configure Port forwarding in Mikrotik easily. If you need guidance in this field, ask us your question in the comments section so that we can guide you well and solve your problem.

Thank you for staying with us until the end of the article.

About the Author Liosa F

Love, life, peace and technology are all for the wise man

List of services

Enable port forwarding for the Mikrotik MIKROTIK RB951G-2HnD

1 Log in the router using your user name and password (Default-IP: 192.168.88.1 , Login: admin , password: none)

2 Click " IP "

3 Click " Firewall "

4 Click " NAT "

5 Click button " Add New " to add new rule

6 Chain : dstnat

7 Protocol : tcp

8 Dst. Port : 80

9 In. Interface : ether1-gateway (one of an interface on the router)

Mikrotik MIKROTIK RB951G-2HnD Steps 10-13

10 Scroll page down to " Action " field

11 Action : dst-nat

12 To Addresses : 192.168.88.253 (IP address of the computer cFos Personal Net is running on)

13 To Ports : 80

Mikrotik MIKROTIK RB951G-2HnD Steps 14-16

14 Scroll back on top of the page and check if the rule enabled (by default it is Enabled)

15 Click " Apply "

16 Click " OK " and then logoff from the router

Port forwarding is now configured for your computer!

Port Forwarding On Mikrotik [Complete]

[Updated] Mikrotik is a powerful router used to increase boot speed to provide automated performance. It provides hardware and software for Internet connectivity in most of the countries around the world. MikroTik has a very high level of flexibility when it comes to network management that comes with its own sophisticated router. When you install RouterOS on your PC, it will turn it into a router with all the necessary features such as routing, firewall, bandwidth management, wireless access point, backhaul link, hotspot gateway, VPN server, and more. In this article, you will learn about Port Forwarding On Mikrotik . You can check the available Mikrotik VPS Server Services on Eldernode and order that you need.

Table of Contents

Tutorial Port Forwarding On MikroTik Router

The process of intercepting data traffic headed for a computer’s IP/port combination and redirecting it to a different IP and/or port is called Port forwarding. Using Mikrotik helps you to do this. So, you can assign a specific port to a specific service on your network so that the user can access it by entering that port in their software or browser. For example, you have a website with port 8080 inside your organization, and Mikrotik is located as a router between your organization’s internal network path and the Internet. Now, if you are considering outsourcing your IP address or domain with a port to the software within the organization, you should use a forwarding port.

What is port forwarding?

To understand the definition of port forwarding, we need to explain about router first. As you know, your internet service provider assigns one IP address to your internet connection. But when all computers on the internet need a unique IP address, what should be done if you have multiple computers in your house and only one address. Port forwards are setup in your router. To make a computer on your home or business network accessible to computers on the internet (Even though they are behind a router). So, you need to do port forwarding. In the case of gaming, setting up a security camera, or downloading files, you will need to follow this instruction.

How to configure port forwarding on MikroTik

As an IT administrator when you create a big network, users may ask to remotely connect to your VPS server or dedicated server . Undoubtedly, you will not share the server IP with him for security purposes. So, you will use port forwarding on MikroTik Router to handle all requests. Let’s see what are the required steps to achieve this purpose.

Then click “ Firewall ” from the “ IP ” menu.

From the Firewall page, click on the NAT (Network Address Translation) tab to open its settings and handle the packets that the router receives.

In the “ NAT ” tab, click on the “ + ” item to create a rule.

In this step, you should click on the “ General ” tab. Select “ dstnat ” from the “ chain ” drop-down list. In the “ Dst. Address ” field type this IP (10.10.10.10). From the “ Protocol ” list, select the connection protocol like (TCP, xdp, ddp). In the “Dst. Port” field, type 5847.

Also, let’s assume the router connects to IP (10.10.10.10) and we want to forward all requests from (10.10.10.10:5847) to the (20.20.20.20:4324).

Then adjust the settings as follows:

Chain : Set this section to dstnat.

Protocol : If you want a particular protocol packet to be forwarded only, set the Protocol option.

dst port : In this section, enter the port you want to access on the Internet.

Then go to the Action tab:

Action : Set this option to dst-nat.

To Addresses : Enter the address of the server inside your organization in this section.

To port : Enter the internal server port where you intend to transfer traffic to.

Note: You can either input and output ports alike or import ports differently.

Now, click on the “ Action ” tab. From the action drop-down list, select “dst-nat”. Type this IP (20.20.20.20) on the “ To Addresses ” field and type 4324 on the “To Ports” field.

In the final step, you should click on Apply and OK to save and add the rules.

In this article, you learned How To Port Forwarding On Mikrotik. Using Mikrotik allows you to manage anything related to networking. Following the mentioned steps helps you to do port forwarding on Mikrotik. If you are interested in reading more, refer to How to Configure IP settings in Mikrotik .

How useful was this post?

Click on a star to rate it!

Average rating 2.3 / 5. Vote count: 3

No votes so far! Be the first to rate this post.

alexander wood

Leave your comment.

Your email address will not be published.

Starting From $15.86/mo

How to Create Backup Service with Virtualizor

We are by your side every step of the way

Think about developing your online business; we will protect it compassionately.

+8595670151

7 days a week, 24 hours a day

Port forward on Mikrotik Router

Port forwarding to internal web server.

According to the network diagram, there is a Web Server (IP: 192.168.10.10) in internal network and now it is only accessible from internal network. Configuring MikroTik Port Forwarding, this Web Server can be accessible from out of this internal network and the following steps will show how to configure MikroTik Port Forwarding to access this internal Web Server from internet/public area.

Most Popular

MikroTik Port Forwarding using Winbox

MikroTik Port Forwarding or Port Mapping is a NAT application that is used to redirect a request from MikroTik IP address and port number combination to a local IP address and port number. For example, if you have a Web Server or FTP Server in your private/local area and want to access this local server from outside of your local area (from internet/public), you can apply MikroTik port forwarding or port mapping and can easily access your Web Server or FTP Server.

Port forwarding configuration in MikroTik Router is not so difficult task. In this article, I will show how to easily configure MikroTik Port Forwarding or Port Mapping using Winbox.

Network Diagram

In this network, MikroTik Router’s ether1 interface is connected to WAN having IP address 117.58.—.198/29 and ether2 interface is connected to a LAN switch having IP block 192.168.10.0/24. There are three servers (Web Server, FTP Server and SSH Server) in internal network and these are only accessible from LAN. Configuring MikroTik Port Forwarding, these servers can be accessible from out of this internal network (from internet/public) and this article will show how to configure MikroTik Port Forwarding to access these internal servers from internet or public network.

MikroTik Port Forwarding Configuration

MikroTik port forwarding can be used for a lot of purposes. Among these, I will only show the following three frequently used purposes.

Port Forwarding to Internal Web Server

Port forwarding to internal ftp server, port forwarding to internal ssh server.

Port forwarding configuration to internal Web Server has been completed. Now type MikroTik WAN IP ( http://117.58.—.198 ) in any Web browser from outside of your internal network and you will find your website in your browser successfully.

Note: You must allow HTTP service or TCP Port 80 in your Web Server firewall otherwise you cannot find your website from public network.

In the network diagram, there is a FTP Server (IP: 192.168.10.20) and we want to access this server from public network. So, we need to configure MikroTik Port Forwarding and the following steps will show how to configure MikroTik Port Forwarding to access FTP Server from public network.

Port forwarding configuration to internal FTP Server has been completed. Now type ftp://mikrotik-wan-ip ( ftp://117.58.—.198 ) in any web browser or use any FTP client (FileZilla) to access your FTP Server from public network. If everything is OK, you will be able to access your FTP Server successfully.

FileZilla FTP Client to Connnect FTP Server

Note: You must allow FTP service or TCP Port 21 in your FTP Server firewall otherwise you cannot communicate with your FTP Server from public network.

We also have a SSH Server (IP: 192.168.10.30) in our network diagram and we want to access this server from outside of our internal network. MikroTik Port Forwarding configuration to access this SSH Server from public network is shown in the following steps.

Port forwarding configuration to access internal SSH Server has been completed. Now we will be able to access our SSH Server from public network successfully by using any SSH client (Putty or SSH Secure Shell Client).

Note: You must allow SSH service or TCP Port 22 in your SSH Server firewall otherwise you cannot communicate with your SSH Server from public network.

If you face any confusion to follow above steps properly, watch the following video about Port Forwarding Configuration in MikroTik Router . I hope it will reduce your any confusion.

MikroTik Port Forwarding Configuration to Access Internal Servers has been discussed in this article. I hope you will now be able to configure your required port forwarding configuration in your MikroTik Router successfully. However, if you face any confusion, feel free to discuss in comment or contact with me from Contact page. I will try my best to stay with you.

Why not a Cup of COFFEE if the solution?

Buy Me a Coffee

Your name can also be listed here. Have an IT topic? Submit it here to become a System Zone author.

11 comments

Dear Abu Sayeed bhaiya As salamu alaikum, I am following your website for a few days which I found really helpful. I am new in network administration. I have read this topic which gives me a vast idea. Regarding this, I have a question. If my ISP/Internet provider/Uplink gives me a private IP (10.10.11.155) as my WAN what will be the procedure to NAT/Port forward. My present Network topology is PublicIP >> Private IP >> LAN. Thanks in advance bhiya 🙂

The main reason for port forwarding is to access local servers/services from outside of your LAN. So, if you don’t have public IP, you will not be able to access your router from public area. According to your network, first you have to NAT from public IP to Private IP and then LAN. But if you don’t control public IP, you will not be able to use port forwarding.

Sayeed I have a local webserver running on LAN, which is connected to my Mikrotik Router, I just want to have my LAN users who are also connected to same network to access my Local Webpage hosted by a WAMP server, what is the work around here? Is it possible to do? hope you will help and guide me.

Thanks in Advance Brother..God Bless You!

No need to do anything in Mikrotik. If your webserver in your LAN, just type IP address in browser’s URL bar and you will get your webpage…

hello to you friends, is this someone could help me, my problem is as follows, I have a local web server and when I access this one from a network of my neighbor is still inaccessible remark j have already followed this tutorial there, but it does not work, my router is Mikrotik

Thanks for your tutorial,,, i want to open shared folder in specific lan (10.0.0.1/24) to outside access,,,

how can i do that using port forwarding ,,,,

many thanks

Usually these ports are used to file sharing. Try to do forwarding thiese… Microsoft file sharing SMB: User Datagram Protocol (UDP) ports from 135 through 139 and Transmission Control Protocol (TCP) ports from 135 through 139. Direct-hosted SMB traffic without a network basic input/output system (NetBIOS): port 445 (TCP and UPD).

hello every one i have two static ip i want access a device (call center related) access from outside network what is the configuration in mikrotik router.

Implement Destination NAT following this article.

Dear Abu Sayeed, am new to System Administration though i have some knowledge, but my major problem is am trying to run a Node and I need to port forward to my laptop but I’ve tried and its not working. Please help

Please follow the instruction which is enough for port forwarding in MikroTik RouterOS.

port mapping mikrotik

IMAGES

VIDEO

COMMENTS