0

I am stuck with one issue. What I have: PC on the office with continious integration server (it has web UI):80 port and sinopia for private npm packages:9314 port. I need to settle vpn throuh AWS MikroTik router, I've got config how to do that (*.rsc file), but primary it was meant to reach only web UI of CI server (meaning 80 port only), now I need to organize things in this way:

  1. Connect to CI web UI via: 'public.adress.of.router'
  2. Connect to web UI of npm repo via: 'public.adress.of.router:9314'

Current config:

/interface bridge
add name=hotpsot-bridge
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=hs-pool-2 ranges=10.5.50.2-10.5.50.254
/ip dhcp-server
add address-pool=hs-pool-2 disabled=no interface=hotpsot-bridge lease-time=1h \
    name=dhcp1
/ppp profile
set *FFFFFFFE local-address=10.127.0.1 remote-address=10.127.0.2
/interface pptp-server server
set enabled=yes
/ip address
add address=10.5.50.1/24 comment="hotspot network" interface=hotpsot-bridge \
    network=10.5.50.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server network
add address=10.5.50.0/24 comment="hotspot network" gateway=10.5.50.1
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=\
    10.127.0.2 to-ports=80
    add action=passthrough chain=unused-hs-chain comment=\
    "place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
    src-address=10.5.50.0/24
add action=masquerade chain=srcnat comment="masquerade PPTP network" \
    src-address=10.127.0.0/24
/ip service
set www disabled=yes
/ppp secret
add name=## password=##

/system identity
set name=##

I was playing around NAT rules, with ports and stuff and noticed that independently of rules 9314 port is closed on router (thanks, nmap), I guess that might be the issue, but still I am asking to help me out with this configuration

Law29
  • 3,507
  • 1
  • 15
  • 28
Dmytro
  • 1
  • 1

1 Answers1

0

nat rule is not enough, you need also corresponding firewall filter rule (on forward chain):

/ip firewall filter add chain=forward dst-address=10.127.0.2 protocol=tcp dst-port=80 protocol=tcp action=accept

bajodel
  • 26
  • 5