How to create on MikroTik proper NAT rule (port forwaring) for external and internal network (Hairpin)

Express guide how to to create proper NAT rule (port forwaring) for external and internal network on MikroTik (so called Hairpin NAT).

For imagination this is our lab environment where we want to create port forwaring for external clients and internal clients as well:

  • Internal network: 192.168.1.0/24
  • Gateway IP: 192.168.1.1
  • External IP: 93.180.10.10
  • Desired port forwarded service: 192.168.1.155:80

This is workflow how Hairpin NAT must proceed:

  1. Internal IP of the Client (192.168.1.10) > External IP of the Router (93.180.10.10)
  2. Internal IP of the Router (192.168.1.1) > Internal IP of the NATted server (192.168.1.155)
  3. Internal IP of the NATted server (192.168.1.155) > Internal IP of the Router (192.168.1.1)
  4. External IP of the Router (93.180.10.10) > Internal IP of the Client (192.168.1.10)

Most mistakes of creating NAT rules is step 1. is proceeded but later is discarded because it expects reply back from 93.180.10.10 and not from 192.168.1.155 (so communication can’t go directly client to client internally).

To create proper Hairpin NAT do following:

  • First in order of proceeding – This is by default pre-created rule src-nat local-to-internet masquerade in ip firewall nat

  • Second in order of proceeding – Create another src-nat which will take care of local-to-local masquerade.

  • Third in order of proceeding – This dst-nat forwards local and external traffic to port 80 via external IP to 192.168.1.155 port 80.

If you wish to create additional NAT rules repeat third step.

Leave a Comment


NOTE - You can use these HTML tags and attributes:
<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: