So I'm using an L2TP/IPSec VPN service which allows me to forward ports so I can access servers on my local network from the public internet. This works great when I've got my Windows PC as the client with its firewall disabled. I can see that my ports are open and my running services are accessible. However, now I'm using my Mikrotik router as the L2TP client having followed the tutorial here (using L2TP instead of PPTP).

I've setup NAT masquerade, configured the mangle and routes and all my network traffic is now being routed via the VPN and it works great except that I'm not able to see my open ports any more. Everything else is configured as default. I've tried to configure dst-nat but to no avail. I guess what I'm asking is how can I port forward on a VPN interface or more specifically, how can I access Plex when it's running behind a router which is working as a VPN client? (My VPN service supports port forwarding). Cheers.

Firewall NAT:

Flags: X - disabled, I - invalid, D - dynamic 
 0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface=ether1 

 1    chain=srcnat action=masquerade out-interface=VersaVPN log=no log-prefix=""

Firewall Mangle:

Flags: X - disabled, I - invalid, D - dynamic 
 0    chain=prerouting action=mark-routing new-routing-mark=L2TP passthrough=yes src-address= log=no log-prefix="" 

Your router is acting as, well, a router. You need to not only port forward from the VPN service to it, but you need to port forward from it to your server. Port forwarding is a special type of NAT called DNAT. Here's a basic example of how to forward a port:

/ip firewall nat add chain=dstnat dst-address= protocol=tcp dst-port=8822 action=dst-nat to-addresses= to-ports=22

This will take anything the router receives destined to port 8822/tcp, and send it to port 22/tcp. You would set to your VPN IP address and to your computer's IP.

  • That's my issue, I've tried adding a dst-nat rule but it won't work. No traffic over that port is being forwarded to my server. Do I need to take some extra steps when I'm running a Masquerade as well? Do I need to setup any routes? – Chris Mar 15 '18 at 0:07
  • Set up the dnat rule again and update your question's export. – Duncan X Simpson Mar 15 '18 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.