My customer has this setup TP-Link TD-8840T (ISP connection) -> RB2011UiAS-2HnD-IN (the main router that divedes all the traffic).

The RB2011 has a ip address (connected to tp-link device) (gateway) and the server

I've setup a port formwarting for ssh on the RB2011 according to this tutorial http://www.icafemenu.com/how-to-port-forward-in-mikrotik-router.htm

Then when trying to connect to the router address on the ssh console shows up.

I've setup a NAT on the tp link which should work the same (forwarding 22 port to But cant get it to work and I don't know if this is due to the RouterOS lacking in some configuration or the tp-link device doe's not forward it further.

The RouterOS is very intimidating to me at this I've fond something called Harpin NAT tried to make the configuration but with no luck.

partial solution

I've made a workaround which right now is sufficient. I've setup the TP-Link device to work as a bridge.

the above solution doesn't work after all

It seems the problem is the Mikrotik (Routerboard) router - which can be accessed now via ssh but the port forwarding setup I've made doesn't work.

It should now forward the connection on the 2323 port to the computer with address on port 22 (ssh port).

The forwarding is blocked for some reason. I also tried to disable all other rules that could be blocking external connections with no luck as well.

simplified diagram

  • just to confirm.. server running ssh is .. that server's gateway is and that's the LAN side of the RB2011, the WAN side of the RB2011 is ? and the TP Link is as the LAN address and the external IP address is X.y.y.y (you can give the first octet like .. external ip is 74.x.x.x, this is just to get a better picture without adding confusion to the 8840T and its internal verses external IP's. TY – TG2 Oct 3 '16 at 10:24
  • Yes. the wan side od RB2011 is, the external 83.x.x.x (wan of the tp-link) – adam Oct 3 '16 at 11:00
  • Please, please put but some form of diagram you can even use Draw.io to make it. Did you could setup some kind of sniffer to see whenever packets actually reach the final host so you'd know that it's only working one way. – Seth Oct 14 '16 at 10:29
  • I've added a simplified diagram – adam Oct 14 '16 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.