MikroTik Router OS Hairpin NAT with Dynamic WAN IP and port forwarding

Подписаться 1,6 тыс.

Просмотров 51 тыс.

50% 1

In this video I go over my fairly well polished MikroTik RouterOS way of getting a hairpin NAT solution and ensuring it has the ability to adjust itself dynamically as and when your WAN IP changes.
It's super easy, free and requires only a slight change in how you normally apply port forwards.
Find more MikroTik tutorials in my channel or on my websites at www.steveocee....
miknet.co.uk

Опубликовано:

14 окт 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 263

@boryswwa 3 года назад

FINALLY someone explained this to me in a way that I'm able to understand and implement. I've been struggling with this for few days now. There are many videos about how to set this up, but none worked for me, until I found this explanation. (First - Hairpin NAT rule should be ABOVE the regular masquerade rule. Second - the trick with dynamic public IP mapping to Address List). THANKS!

@SteveoceeCoUk 3 года назад

Glad you enjoyed. Thank you

@skysurfer Год назад

You have the gift my friend, taking a complicated subject and breaking it down into steps that are understandable. There are a lot of over engineered solutions to this, and yours is by far one of the easiest to comprehend. Worked for me on the first go. The humor in the video was also appreciated :)

@pieterbeukes6294 Год назад

Awesome, someone explaining Hairpin NAT straight forward and so easy to implement

@darkog9767 Год назад

The best explanation on hairpin NAT with Dynamic IP. Thank you!

@vk1nfi 3 года назад

MATE THANK YOU! I have been wanting to do this ever swapping to Mikrotik, but just put up with the fact it didn't work. But today I have recently needed it to work and after pulling out what little hair I have left all day. I have sat down with a beer and found your video. You are a dead set legend and I wish I could shout you a beer!

@SteveoceeCoUk 3 года назад

Glad it worked for you. Thanks for the view.

@donEthano 5 месяцев назад

I've been struggling with port forwarding on :80 for quite some time, untill I've found THIS GOLD!!! Thank You Very Much!!!!!!!!!!! Great tutorial, 100% worked for me.

@SteveoceeCoUk 5 месяцев назад

Glad I could help!

@rodneyyeo7744 4 месяца назад

Yes, your guide help me too. Thanks alot! ❤

@jpdub45 4 года назад

I've been trying to figure this out for home assistant/ duckdns for probably 6 hours today, and your video has been the first helpful thing I've found today. Thank you!!!

@LucianPantea 2 года назад

By far the best explanation on how to set hairpin NAT. Thank you! This helped me and was extremely informative.

@freshgino 2 года назад

This video is 100% correct. The forums and other outdated bs out there just all need to link here. You must change all your port forwarding rules to use the address list as the destination before the Hairpin NAT rule will work. The Mikrotik App defaults the port forwarding setup to use the WAN interface.

@_Callum.22 3 года назад

I've struggled for months to get this to work - I had to watch your video twice, but this finally fixed it! The dynamic IP part was a bonus, too!

@SteveoceeCoUk 3 года назад

Glad it helped. Thank you for the watch time.

@anthsham 2 года назад

I have been looking for a solution to this problem for longer than I care to admit. Thank you!

@lestatt77 5 лет назад

I truly appreciate your tip, I have been trying to do hairpin NAT for a while now

@iqbaltiro 4 года назад

Thanks for the tutorial mate, I've been scratching my head for almost a year trying to solve this :) I am used to OpenWrt and was getting bored with it, and wanted to try something else, then I chose Mikrotik. Hairpinning is the default for OpenWrt, but in Mikrotik it is completely different, you have to set it your self.

@UltimateByte Год назад

Thank you so much for this! I didn't find any documentation providing a rule that would work (at all and on top of that) for everything at once before yours. Also I'm now using address lists thanks to you! Cheers mate!

@lolicolonlinez8844 3 года назад

This is by far the easiest way to fix this issue. Thank you, you saved me hours!

@MrTVintro 5 лет назад

This is such an infinitely more practical solution...

@arogantech 4 года назад

The BEST explanation on how to configure hairpin. THANK YOU!!

@SteveoceeCoUk 4 года назад

Glad you liked it, thank you.

@markormesher3360 3 года назад

Thank you so much for sharing this! Pulled my hair out for an hour trying to fix this and you just showed me how in a few minutes.

@Geniuseus 5 лет назад

Works like a charm! Also, if you use the "address type" switch on your port forward rules and set it to "local", you don't need any magic with the "cloud" settings

@SteveoceeCoUk 5 лет назад

If you activate the "local" option though that means no actual WAN traffic will match and the rule would only work for local traffic?

@Geniuseus 5 лет назад

@Steveocee to be fair, I'm really a beginner regarding Mikrotik routers, so I'm not sure, but the harpinning works this way. If you'd like, I can share the relevant config parts.

@SteveoceeCoUk 5 лет назад

Yes totally agree, from your LAN the hairpinning will work but it will not forward for people outside of your LAN (ie WAN port forwarding). This is because the matcher specifies a local address. My solution does not care, LAN or WAN as long as the destination IP is the WAN IP :-)

@KarlHamilton Год назад

Aaah. Very clever. But even more importantly, very elegant! Just what I need. Subscribed.

@BelFaRo2008 4 года назад

Work of two evenings until i found your Video... Thank you very much, Sir!

@SteveoceeCoUk 4 года назад

Thank you and no worries my friend. Have a look around my "old" site www.steveocee.co.uk and also my new site miknet.co.uk for more!

@FlexibleToast 3 года назад

This video made what seems like a difficult topic if you search around the forums, very easy. Such an elegant and easy solution.

@Anachroschism 5 лет назад

Your guides are very easy to follow, which I certainly appreciate. Now I just need a DMZ zone tutorial that is as easy to follow.

@SteveoceeCoUk 5 лет назад

I'm glad you like them! I don't/didn't have plans for a DMZ tutorial BUT please feel free to get in touch through my website and I will sort you the right config out. It's relatively straight forwards to do!

@realkahlil 5 лет назад

Fantastic job. I wish this was in the manual. You made it so simple. Since, I already am using Duck DNS I used that and it seems to be working. Thank you for this video. I was trying so many other complicated things for no reason.

@neelkanthgovindji1173 7 месяцев назад

Thank you a ton! this helped me figuring out the NAT Loopback issue I had.

@AshtonClemens 5 лет назад

Thank you! Using the IP address instead of the interface fixed my NAT reflection problem.

@jvik 2 года назад

This was really clever. I regret not finding this video a long time ago.

@Heckatomba 4 месяца назад

Thank you very much for the clear explanation. Worked for me as well. Although I made one small change. Rather than using DDNS, I copied somebody else's script (found on Mikrotik forum) so the DHCP client updates the address list by itself: :if ($bound=1) do={ /ip firewall address-list set [/ip firewall address-list find where comment="wan1ip"] address=$"lease-address" disabled=no } else={ /ip firewall address-list set [/ip firewall address-list find where comment="wan1ip"] disabled=yes }

@SteveoceeCoUk 4 месяца назад

Thank you - This works due to the dhcp client on the WAN - the DDNS method accommodates better to pppoe but if it works it works! I’d prefer a non cloud reliant version so yours is very appealing 😂

@shahriarshojib 5 лет назад

OMG can't believe i wasted 1 hour trying to figure this out, Thanks for the tutorial, Very helpful. I am sure the dynamic ip forwarding will come in handy to a lot of peoples as well.

@SteveoceeCoUk 5 лет назад

Glad it helped you out! Check my channel for more videos!

@wanttotree Год назад

Hey this one helped me a lot. Now im back to mikrotik because of your video! Cheers mate.

@igradeanu 7 месяцев назад

Amazing clear and funny explanation! After searching around for quite some time, this helped me a lot! Let alone the lovely English accent. :)

@biv88 11 месяцев назад

Thank you this should be page one on search engines not a random link on the forums

@coeniejvr 2 года назад

THANK YOU, it worked for me by leaving in interface blank

@paulnolastname4298 4 года назад

Spot-on, thanks. I have my no-ip updated by my NAS already so the address list trick was even easier (just use address lists to resolve the already existing ddns address). Greatly appreciated.

@cosmin5766 Год назад

This tutorial saved me after 8 hours of trial and error. Thanks a lot!

@SteveoceeCoUk 4 месяца назад

Glad it helped

@FinlayDaG33k 5 лет назад

I have been searching for this for a few hours now and didn't think something as simple as this would solve it

@rsur2000 3 года назад

Thank you so much for this video. I've been looking for this. Now I can make hairpin NAT works in my network

@SteveoceeCoUk 3 года назад

Thank you for your time watching.

@anyoneoreally7996 Год назад

Amazing! Thank you, sir! I come from the Linux perspective where this is much easier, but thanks to your explanation which builds a bridge for me now I understand how to achieve it on Mikrotik router (which happens to be my ISP's choice). Respect!

@themorleyc 5 лет назад

Saved hours from all other posts with 1 line and simple understandabe explantion. Subscribed!

@SteveoceeCoUk 5 лет назад

Glad it worked for you and thank you for the sub :-)

@youbecha64 6 лет назад

Thanks! This solved my problems...of course I had an additional problem of having an "In. Interface" listed for my dstnat forwarded ports...once I got rid of those (to match your screen) my loopback (hairpin) started working!

@SteveoceeCoUk 6 лет назад

Yes you need to make sure you don't specify an "in.interface" as otherwise you are adding un-needed matchers.

@generallisimus_ 3 года назад

Best guide I ever see on these theme. Thank you!

@AttilaMatolcsy 2 года назад

I almost left a keyboard smash here in my happiness. THANK YOU! It's finally working for me.

@richardvanorsouw9642 5 лет назад

Thanks mate, fixed my issue with 443 and 80 NAT

@mobiusphantom3489 2 года назад

Nice video - My Unify gateway died so I hauled out an RB2011 I had lying around. (Public holiday so had to work with what I have and to be fair its a good device). The one remaining thing was accessing my web server internally - I could have just fiddled with internal DNS to point to the internal server but thats messy. This was easy and the hairpin NAT helps a lot.

@FireWallCR 5 лет назад

I was trying a lot of Hairpin-Rules, this was easiest I found and worked. Thanks a lot! Pura Vida!

@SteveoceeCoUk 5 лет назад

Thank you for watching my video and I'm glad it worked for you!

@realivanjx 4 года назад

thanks. since i already have the ddns service from my isp i skip the cloud thing from mikrotik and all is working now. thanks

@l4nsocrates 5 лет назад

finaly! THANKS, reading hours of mikrotik forum, and you got it to me in 7 minutes!

@SteveoceeCoUk 5 лет назад

Annoying isn't it? I spent hours on the forums and was amazed how well this worked when I tried it out.

@tuxillo 4 года назад

If you're already updating a hostname with your dynamic IP address in a DNS service via a script (like I do), you could use that hostname for the address list too and entirely skip the cloud step. Thanks for the trick.

@SteveoceeCoUk 4 года назад

Totally correct. The "beauty" if you like of my solution is there is no scripting needed so one thing less to potentially not go wrong or one layer less of complication. Thanks for watching!

@lassivaatamoinen5468 3 года назад

Nice one! Was just wondering about this on my 2nd evening with MikroTik NAT configuration session. Kind of had this idea but not sure how to put it into MikroTik terms

@Anavllama 4 года назад

Sweet use of firewall address lists. If someone has an existing dyndns provider they can use that in the firewall address list vice the MT cloud one (but assumes one already has a script on the router to update the dyndns provider info). The key points being one only needs hairpin nat if users are attempting to reach a server on the same LAN but using the public IP vice the more direct internal LANIP (yes seems to be a frequent requirement although seemingly strange) and that the additional hairpin srcnat rule has to be the first srcnat rule. Cheers mate Gluck iwth MikNET!!

@MatyasPesek 3 года назад

OMG! you saved my life, I've been trying to figure it ou for a week now, thank you so much, you're awesome!

@SteveoceeCoUk 3 года назад

Thank you

@dberzins Год назад

Thank you so much for this helpful explanation!

@CakeandCookieLP 3 года назад

Goddamn, this was soooo easy. How has no one else explained this so well? Thanks, definitely subscribed!

@SteveoceeCoUk 3 года назад

Than kyou for your watch time and kind words.

@amarochemez 4 года назад

Thanks very much from Argentina!

@danielessien2445 8 месяцев назад

Thank you so much ... have been on this for months

@mehmetcanakpinar1644 4 года назад

Thanks a lot. I am using static ip and it helped me a lot.

@hospitaldepcadum4760 5 лет назад

IT WORKS!!!!!!! THANKS i am using mikrotik and have 1 server behind it. and also a lot of lan users.

@SteveoceeCoUk 5 лет назад

Glad it works for you and thank you for taking the time to let me know :-)

@JeanFrancoCaringi 4 года назад

IT WORKED! FINALLY SOMEONE explain it well!

@SteveoceeCoUk 4 года назад

Thanks for stopping by and the comment. Check out my new site www.miknet.co.uk as I'll be adding similar awesome MikroTik tricks and tips in the near future.

@JeanFrancoCaringi 4 года назад

@@SteveoceeCoUk sure! Thanks Do you have a article/video about the use/configuration of domain names in Mikrotik?

@andreii6938 3 года назад

wow! finally found this after hours of knocking my head against the keyboard! thank you!

@SteveoceeCoUk 3 года назад

Glad I could help!

@fujitsubo3323 5 лет назад

thanks dude, i used this to get it working with my static ip. i followed the wiki guide years and years ago and could not get it working becuase im dumb as dog shit, but following your guide its all working, good day to you fine sir

@russianfool 4 года назад

Fantastic! Most practical case on here that fits the exact setup :)

@slabegregor 6 лет назад

Finally. I was struggling a lot with this one and now finally it works. Thanks mate ;)

@franzgreiner-stoffele8091 5 лет назад

Hi Steveocee, thank you so much. This helped me a great deal. This is the first time I leave a comment, but it is worth wile.

@SteveoceeCoUk 5 лет назад

Hi, Thank you for your comment. It's great to know that my work does help :-)

@Refresh5406 4 года назад

You just saved me hours of work, thank you!

@FireWallCR 4 года назад

The Best and to the point!. Thank you so much from Costa Rica....

@SteveoceeCoUk 4 года назад

Thank you for the watch and comment. Glad you like it and hope it helped.

@Fadeevator 3 года назад

Friend of mine gives me another solution: Static DNS. Name is your ddns, ip is your HASS ip. It still need to be used with default port in local network (like 8123), but works like a charm, simple and quick. Also you need to do ipconfig \flushdns on your computers that you previously connect to HASS.

@SteveoceeCoUk 3 года назад

How does that work on devices you can't enter static DNS like mobiles? My solution works network wide no matter what device 👍 No static entries needed.

@Fadeevator 3 года назад

@@SteveoceeCoUk sorry, my explanation was bad. I did a static dns on mikrotik, so any device that locally adresses to ddns goes straight back to local ip of my hass.

@Fadeevator 3 года назад

And one simple dstnat port forward like one on your video for external clients.

@XOmrfloyd 5 лет назад

Damn, that Cloud option saved the day! THX

@marcetech515 4 года назад

Dude!! it absofuckinglutely worked!! Thank you very much! IT saved me a lot of time and refractoring since I code, and I have been changing the url variables in order to get acces to my services hosted with the public IP! Your video got my stack working by the minute 3 of your video! Once again, thank you very mucho!! Cheers mate!

@SteveoceeCoUk 4 года назад

Thank you, glad it helped you out.

@jaspertax 3 года назад

You have made my day! Thanks for this great tutorial :D

@SteveoceeCoUk 3 года назад

Glad I could help you out.

@marine1718 2 года назад

Thank you u just saved my day with that i had a lot of problems i didnt knew that the name was harpin nat!

@AttitudeGames 4 года назад

I know this video is over 2 and a half years old, but thanks so much, was trying to port forward on the RB4011iGS+ for ages wondering why it would work fine externally but fail internally. Also thanks for the work around for a Dynamic Public IP, British Telecom hate giving Static IP's out to Residential Customers. Is there a more up to date or better version of this, or is this still the better way to do this.

@SteveoceeCoUk 4 года назад

Hi Paul, BT are a bit of a pain for residential users. In all fairness I'm with Zen now and although they are a touch more money, the support, network performance and inclusive static IP are well worth it. This is still one of the "easiest" ways of doing this with a MikroTik (note I didn't say best as who am I to judge?). Have a browse over my channel, if you can sift through the random game videos there are more MikroTik related tutorials which may give you some inspiration.

@AttitudeGames 4 года назад

@@SteveoceeCoUk Yeah, my brother is with Zen, we stayed with BT due to we don't really need a Static IP and plus paying £54 p/m (including line rental) for their 910Mbit (down) and 115Mbit (up) package and we are getting that speed 24/7 so makes sense to stay LOL As for the other videos yeah I will have to check those out.

@chillzong8754 3 года назад

Sept 2021.. Works great. thanks so much for this great tutorial

@EndureTemptation 3 года назад

I was trying to set up my Minecraft server. I expected there to be a checkbox in Router interface that says: "Enable NAT loopback". Anything more than that doesn't help me. What I'll do is just ignore the problem. Thanks for trying to help!

@NomadAerial 4 года назад

3:18 had me rolling! Video seemed really professional up until that point. Thanks for the laugh, brother! (And the tutorial!)

@SteveoceeCoUk 4 года назад

Thank you for the watch and the comment. Professional is not something that describes me lol.

@NomadAerial 4 года назад

@@SteveoceeCoUk There are likely to be a few people I work with who would say the same about me. I've worked in IT for nearly 30 years. I've lost all sensitivity to anyone offended by sounds that come out of my mouth when I work. Besides, I believe, "completely fucking mental" is, in fact, a technical term used to describe a packet storm or a routing loop without depth limits.

@dragos.temelie 2 года назад

Thank you! Your solution worked!

@ika9 Год назад

Thanks man that was a issue for me for long

@brycesterproject 4 года назад

This is exactly what I was looking for, thanks!

@gabusan 5 лет назад

Thanks mate, it worked perfectly... Great tutorial!

@aspen6393 Год назад

You're awesome! Helped me a lot!

@stealthslayer90 6 лет назад

thank you love the dynamic ip setup part!

@AthanasiosRorris 4 года назад

Thank you very much, great guide and explanation.

@ausare32 5 лет назад

Awesome video, I had so much trouble with this!

5 лет назад

First of all, thanks! that resolved my hours of forum reading/trying for hairpin nat... i have one question, i make it work from inside and outside my network by adding 2 rules of port forwarding per port. one using the in-interface=WAN and other like yours using the dst-address-list (one for accessing from outside and the other from inside the network). Is this the cleanest solution? thanks in advance.

@SteveoceeCoUk 5 лет назад

Glad to hear it fixed your problems. You shouldn't need 2 rules though. 1 rule with WAN IP as destination will work as even LAN traffic going by hostname will resolve to the WAN IP. Remove that in-interface and you will be able to run 1 rule per forward :-)

5 лет назад

@@SteveoceeCoUk it didnt work if I remove the in interface rule for outside traffic, only works from inside the lan. Thats the reason I put 2 rules.

@SteveoceeCoUk 5 лет назад

@ Something is wrong if you need to use 2 rules!?!

@pedromartinezdeaguilar9187 2 года назад

Quiet dificult to make it easier, thanks

@DasFlughoernchen 6 лет назад

This was the information i needed! Thanks man!

@criticalmoorhen 4 года назад

You are a FUCKING legend. Thanks a lot!!! You don't realise how much time I wasted on this. Thank you so much. I belive there are more people like me unsuccessfully trying to figure this out.

@SteveoceeCoUk 4 года назад

Thank you, glad I could help you out dude.

@nick2k82 3 года назад

Very good tips my friend. One of the best videos. Good Luck

@jamieheath3105 6 лет назад

Excellent video, thank you!. Just out of interest, suppose you had the MK WAN on the LAN of a BT hub and port forwarded through both routers to get to something inside the MK LAN's and then came in from the outside world then that would be fine. Looping back the dynamic WAN IP obviously works on the LAN side of the MK with these settings but what would happen if you were LAN side of the BT hub and tried it with the dynamic address?

@SteveoceeCoUk 6 лет назад

A very good question! My method assumes a public IP address on the WAN interface which isn't what you'd have in that instance. The BT hub would effectively be doing your hairpin at that point. You could negate all the IP>Cloud stuff and simply make the dst-nat rules as dst-address 192.168.MT.WAN which would have the same effect. A better solution (in my eyes) would be to remove the BT hub altogether and pick up a used Huawei HG612 as a modem then allow the MT to create the PPPoE client itself. Please feel free to contact me through my website www.steveocee.co.uk if you want help with anything and also check out one of my recent posts which shows the HG612 itself as thats the setup I am using currently www.steveocee.co.uk/broadband-upgrade/

@jamieheath3105 6 лет назад

Steveocee Thanks I will do some testing

@paulnolastname4298 2 года назад

Hi Steve, as you can see from the comment below, this worked like a charm the last time I tried it. Recently I broke my router (locked myself firmly out of it - stupid!), factory reset it and then followed this video again ... but it's not working this time (port forwards work from outside the LAN but not from the LAN). This will sound like a daft question but is there a frequent error users make when trying to apply this. Any help is greatly appreciated.

@heathcoleman8848 6 лет назад

Thank Exactly what i was after

@manhle-er3ov 3 года назад

thanks, it really works, saved me alot of time - ALOT

@SteveoceeCoUk 3 года назад

You're welcome!

@rimasxxl 8 месяцев назад

Great, it works!

@salvadorromero8011 3 года назад

I've followed your instruccions, but the only thing that i can't do is to drag and drop the "hairpin nat" rule to the first position, I am running RouterOs 6.48.1. Any help on this? Also tried to drag the masquerade rule down but it doesn't allow me to modify (winbox and/or webfig) Thanks in advance, a great explanation!

@SteveoceeCoUk 3 года назад

Something odd, how are the rules organised? Click the # at the top left to arrange in number order. May be that stopping you if they aren't arranged numerically.

@vokurka-net 3 года назад

I have one update for this video. DDNS (Dynamic domain name) will be "translated" to IP, in address lists, only when you don't use DoH Server for DNS (in IP/DNS). Otherwise it will not "translate" dynamic domain name to IP address. It's strange, but is is. I tried it on HeX S with RouterOS 6.48.1 (Stable).

@vandyklessing8266 2 года назад

Thank you kind Sir!

@stevecole3079 6 лет назад

Great job Steve, thank you

@MrZeynelyenici 4 года назад

I also Truly appreciate your Tip !

@weasalnz1456 3 года назад

i was hoping your guide was going to resolve my issue. the dynamic NAT as i run duckdns and swag runs in docker container. external access works fine, but any attempt to use the same URL internal fails

@AndreasHanfelt 4 года назад

This was really great thank you so much!

@ydimitrushev 4 года назад

You my man are a God!

@SteveoceeCoUk 4 года назад

Not at all. I came across a common problem and tried to find the simplest solution that would work in every scenario.

@ydimitrushev 4 года назад

@@SteveoceeCoUk I really appreciate your time. Thank you! There are so many ways to do bad config on this powerful router/os so your explanation saved me a lot of resetting :)