Utilizing Port Forwarding on Mikrotik Router

by indonetworksecurity

@2013 indonetworksecurity.com

Port Forwarding is a feature on the proxy to forward specific IP with port specified, all other IP port specified as well. Generally used to direct public ip to the client ip (local ip). There are so many benefits of this feature, of which we can access the webserver on the local network even if we are not in a local network. This can also be done not only on service webserver only, but it can also be applied to other service2, such as File Server, Mail Server, SSH Server, VNC Server, and more.

assumptions:
Using WinBox
Public IP from your ISP: 180 241 111 312
Local IP:
- Webserver IP: 192.168.1.10
- Fileserver IP: 192.168.1.20
- SSH Server IP: 192.168.1.30
Forward IP to Web Server
Because web servers generally listen on port 80, so in this case we forward port 80.
Stepnya as follows:
Open New Terminal in Winbox, then type the following command:

/ip firewall nat add chain=dstnat dst-address=180.241.111.312 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.1.10 to-ports=80 comment=”forward web server”

Forward IP for File Server
Such as SAMBA fileserver or else generally listen on port 139. Well .. we are here to change the port to 139.
Open New Terminal of Winbox, then type the following command:

/ip firewall nat add chain=dstnat dst-address=180.241.111.312 protocol=tcp dst-port=139 action=dst-nat to-addresses=192.168.1.20 to-ports=139 comment=”forward file server

for other services can be done in the example above .. just by our changing the direction where the ip in forward and change the port.

Note:
We should not dst-port according to the port listen on its service each. For example, we want to make ip_public: 3000 forwarded to the SSH server (port 22), we can make the following:

/ip firewall nat add chain=dstnat dst-address=180.241.111.312 protocol=tcp dst-port=3000 action=dst-nat to-addresses=192.168.1.30 to-ports=22 comment=”forward SSH server”

It is important to keep the default port is not compromised. so in this case when we want to SSH to Mikrotik Router .. us enough access to the SSH client public ip, it will go directly to the SSH server on the proxy, but if we access the public ip to port 3000 via SSH client, it will be forwarded to the SSH server on the local computer to 192.168.1.30

By : teknosia