More

    Mikrotik 如何設定 Multiple WAN IP 及 Port Forwarding/HAIRPIN NAT

    This Content Is Only For Subscribers

    Please subscribe to unlock this content. Enter your email to get access.
    Your email address is 100% safe from spam!

    我們的場境如下圖,當我們的 WAN IP 有四個時, 1.2.3.1、1.2.3.2、1.2.3.3、1.2.3.4,另外要將不同的服務指向不同的伺服器如下:

    Step One : 設定 Interfaces

    設定 Mikrotik 兩個 Interfaces,一個作為 LAN Port,另一個作為 WAN Port,並設定地址:

    ether1 = LAN users
    ether2 = WAN Link

    1
    2
    3
    4
    5
    6
    /ip addressadd
    address=10.0.0.1/8 comment=LAN disabled=no interface=”LAN – ether1″
    add address=1.2.3.1/29 interface=”WAN – ether2″
    add address=1.2.3.2/29 interface=”WAN – ether2″
    add address=1.2.3.3/29 interface=”WAN – ether2″
    add address=1.2.3.4/29 interface=”WAN – ether2″

    Step Two : 設定 Filter Rules

    目標設定的 Port Forward 如下:

    mail server = 10.0.0.2 → 1.2.3.1    WAN IP (Port 25,110,80)
    dude server = 10.0.0.3 → 1.2.3.2   WAN IP (Port 80)
    cctv1 server = 10.0.0.4 → 1.2.3.3   WAN IP (Port 81)
    cctv2 server = 10.0.0.5 → 1.2.3.4   WAN IP (Port 82)

    我們首先設定 Filter Rules,容許有關的 Incoming Traffic,並 DENY 所有其他不容許的數據流動。

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    /ip firewall filter
    add action=accept chain=input comment=”SMTP” disabled=no dst-address=1.2.3.1 dst-port=25 in-interface=”WAN – ether2″ protocol=tcp
    add action=accept chain=input comment=”POP3″ disabled=no dst-address=1.2.3.1 dst-port=110 in-interface=”WAN – ether2″ protocol=tcp
    add action=accept chain=input comment=”Webmail” disabled=no dst-address=1.2.3.1 dst-port=80 in-interface=”WAN – ether2″ protocol=tcpadd action=accept chain=input comment=”DUDE” disabled=no dst-address=1.2.3.2 dst-port=80 in-interface=”WAN – ether2″ protocol=tcp
    add action=accept chain=input comment=”CCTV 1″ disabled=no dst-address=1.2.3.3 dst-port=81 in-interface=”WAN – ether2″ protocol=tcp
    add action=accept chain=input comment=”CCTV 2″ disabled=no dst-address=1.2.3.4 dst-port=82 in-interface=”WAN – ether2″ protocol=tcp
    add action=accept chain=input comment=”WINBOX 8192″ disabled=no dst-port=8192 in-interface=”WAN – ether2″ protocol=tcp
    add action=accept chain=input comment=”Allow PING ICMP ” disabled=no protocol=icmp
    add action=drop chain=input comment=”DROP ALL INCOMING TRAFFIC ON WAN INTERFACE” disabled=no in-interface=”WAN – ether2″

    Step Three : 設定 NAT 及 Port Forwarding 的設定

    目標設定的 Port Forward 如下:

    1
    2

    3

    4

    5

    6

    7




    8
    9
    10
    11
    12
    /ip firewall nat
    add action=dst-nat chain=dstnat comment=”SMTP 25 Forward to MAIL-Server” disabled=no dst-address=1.2.3.1 dst-port=25 in-interface=”WAN – ether2″ protocol=tcp to-addresses=10.0.0.2 to-ports=25
    add action=dst-nat chain=dstnat comment=”POP3 110 Forward to MAIL-Server” disabled=no dst-address=1.2.3.1 dst-port=110 in-interface=”WAN – ether2″ protocol=tcp to-addresses=10.0.0.2 to-ports=110
    add action=dst-nat chain=dstnat comment=”Web 80 Forward to MAIL-Server Webmail” disabled=no dst-address=1.2.3.1 dst-port=80 in-interface=”WAN – ether2″ protocol=tcp to-addresses=10.0.0.2 to-ports=80
    add action=dst-nat chain=dstnat comment=”Web 80 Forward to DUDE” disabled=no dst-address=1.2.3.2 dst-port=80 in-interface=”WAN – ether2″ protocol=tcp to-addresses=10.0.0.3 to-ports=80
    add action=dst-nat chain=dstnat comment=”CCTV1 – 81 Forward to cctv1″ disabled=no dst-address=1.2.3.3 dst-port=81 in-interface=”WAN – ether2″ protocol=tcp to-addresses=10.0.0.4 to-ports=81
    add action=dst-nat chain=dstnat comment=”CCTV2 – 82 Forward to cctv2″ disabled=no dst-address=1.2.3.4 dst-port=82 in-interface=”WAN – ether2″ protocol=tcp to-addresses=10.0.0.5 to-ports=82 

    ### Now route specific local servers traffic from specific WAN IP address 

    add action=src-nat chain=srcnat comment=”Rotue mail traffic via 1.2.3.1″ disabled=no src-address=10.0.0.2 to-addresses=1.2.3.1
    add action=src-nat chain=srcnat comment=”Rotue DUDE traffic via 1.2.3.2″ disabled=no src-address=10.0.0.3 to-addresses=1.2.3.2
    add action=src-nat chain=srcnat comment=”Rotue CCTV1  traffic via 1.2.3.3″ disabled=no src-address=10.0.0.4 to-addresses=1.2.3.3
    add action=src-nat chain=srcnat comment=”Rotue CCTV2  traffic via 1.2.3.4″ disabled=no src-address=10.0.0.5 to-addresses=1.2.3.4 
    add action=masquerade chain=srcnat comment=”Default Masquerade Rule for LAN” disabled=no out-interface=”WAN – ether2″ src-address=10.0.0.2-10.0.0.255

    Step Four : 設定 HAIRPIN NAT

    1
    2


    3
    4
    5
    # DST-NAT rule to redirect port 3389 from
    /ip firewall natadd action=dst-nat
    chain=dstnat disabled=no dst-address=1.2.3.4 dst-address-type=local dst-port=3389 protocol=tcp to-addresses=192.168.1.10 to-ports=3389 comment=”Redirect RDP PORT  TCP 3389 to local server” 
    # Masquerade local traffic going to mikrotik WAN IP – [To access that service from LAN using mikrtoik wan ip]
    /ip firewall nat
    add chain=srcnat src-address=192.168.1.0/24 dst-address=192.168.1.10 protocol=tcp dst-port=3389 out-interface=LAN-Interface action=masquerade comment=”Masquerade Traffic going to WAN IP of mikrotik from local LAN users”

    Source : https://aacable.wordpress.com/2013/11/13/mikrotik-with-multiple-wan-ips-and-port-forwarding/

    Recent Articles

    spot_img

    Related Stories

    Stay on op - Ge the daily news in your inbox