Destination NAT with dst-nat and Redirect

What it is

Destination NAT changes the destination address or port of packets that arrive at the router.

Its best known use is port forwarding. A server on the private LAN has no public address, so the router accepts connections on its public address and passes them to the server.

RouterOS has two actions for this. The dst-nat action sends the traffic to another address. The redirect action sends it to the router itself.

How it works

The rule sits in the dstnat chain, which is checked before the routing decision, and the translated packet then follows the normal routing and filter rules.

The dstnat chain

The dstnat chain of the NAT table handles packets as they arrive, before the router decides where to route them. This order is needed, because the router must know the real destination before it can route the packet.

As with source NAT, only the first packet of a connection meets the rule. Connection tracking handles the rest, and it also changes the source address of the replies back to the address the client used.

The dst-nat action

The action replaces the destination address, and optionally the port.

/ip firewall nat add chain=dstnat protocol=tcp dst-port=8080 in-interface=ether1 action=dst-nat to-addresses=192.168.88.20 to-ports=80

The rule says: when a TCP packet arrives on ether1 for port 8080, send it to the server 192.168.88.20 on port 80.

The matching parameters decide which traffic is forwarded.

If the router has several public addresses, match with dst-address so that only one of them is forwarded. If it has a single address that can change, match with in-interface instead.

Use a different outside port from the inside port when you want to hide a service, or when two servers need the same service. For example, port 8080 can lead to server A and port 8081 to server B, both on port 80.

The redirect action

The redirect action changes the destination to the router itself. The packet is then handled by a service that runs on the router.

/ip firewall nat add chain=dstnat protocol=udp dst-port=53 src-address=192.168.88.0/24 action=redirect to-ports=53

This rule catches DNS requests from the LAN and hands them to the DNS service of the router, whatever server the client asked for. A similar rule can send web traffic to a proxy that runs on the router.

The to-ports setting gives the port on the router. The destination address is always the router.

Allowing the translated traffic

NAT changes the address, but the firewall filter still decides whether the packet may pass. If the forward chain drops new connections from the WAN, the forwarded traffic is dropped too.

The standard solution is to let the filter recognise traffic that NAT has translated.

/ip firewall filter add chain=forward connection-nat-state=dstnat connection-state=new in-interface=ether1 action=accept

The connection-nat-state=dstnat condition matches connections that a dstnat rule has translated. Placing this accept rule before a general drop keeps published servers reachable and still blocks everything else.

In the filter, the destination is already the private address, because the dstnat chain runs first. A filter rule must therefore name the private address and port, not the public one.

LAN clients that use the public address

A common surprise is that LAN hosts cannot reach the published server through the public address. The packet goes to the server directly, and the server replies straight to the client, which does not expect that reply.

A source NAT rule for this traffic fixes it. This is sometimes called hairpin NAT.

/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.20 out-interface=bridge1 protocol=tcp dst-port=80 action=masquerade

The rule makes the reply travel back through the router, so the translation works in both directions.