MikroTik RouterOS 7 NAT & Port Forwarding

Pick the translation you need

NAT changes packet addresses. It is not an authorization policy. In RouterOS, the forward filter evaluates a forwarded packet after destination translation; match the inside address and translated port there. A packet addressed to the router itself uses input instead.

Outbound NAT

/ip/firewall/nat/add chain=srcnat src-address=10.42.50.0/24 out-interface-list=WAN action=masquerade

WAN must contain the routed uplink. For a stable public address assigned by your ISP, use src-nat instead; 192.0.2.18 below is a documentation address and will not work on the public Internet.

/ip/firewall/nat/add chain=srcnat src-address=10.42.50.0/24 out-interface-list=WAN action=src-nat to-addresses=192.0.2.18

Choose one applicable rule. Keep VPN no-NAT exceptions ahead of a general source translation when required by the tunnel design. Masquerade clears associated tracked connections when the interface disconnects or its address changes; fixed src-nat has different failover behavior.

Publish one service to one permitted source

Assumptions: WAN has a public IPv4 address, the server is 10.42.50.20 listening on TCP 443, and a remote administrator has a stable source IP. The example maps external TCP 8443. Replace documentation source 198.51.100.44 with the authorized real source; it intentionally admits no real Internet client as written.

/ip/firewall/nat/add chain=dstnat in-interface-list=WAN src-address=198.51.100.44/32 protocol=tcp dst-port=8443 action=dst-nat to-addresses=10.42.50.20 to-ports=443 comment="Restricted service publication"

Place the following forward rule before the final forward drop. Adding it at the end of an existing policy will not bypass an earlier drop. Identify the correct position in your own rules; do not use an arbitrary rule number copied from another router.

/ip/firewall/filter/add chain=forward action=accept in-interface-list=WAN src-address=198.51.100.44/32 connection-nat-state=dstnat protocol=tcp dst-address=10.42.50.20 dst-port=443 comment="Allow restricted published service"

If the WAN has multiple public addresses, add a dst-address match to the NAT rule for the intended public address. A single WAN-list rule otherwise matches that port on every address arriving through the list. Use a VPN for routine router administration. Do not publish WinBox, SSH or device control panels by default.

Hairpin: why a LAN test can fail

The WAN-only dstnat rule above does not match a LAN client. Split DNS can send internal clients directly to the service’s internal address. If you deliberately use hairpin NAT, create a separate LAN dstnat match for the specific public destination, then a narrowly scoped source translation when client and server share a subnet. Otherwise the server can reply directly, bypassing the router that must reverse the translation. Hairpin source translation also hides the original client address from the server.

Changing rules and testing

/ip/firewall/nat/print stats
/ip/firewall/filter/print stats
/ip/firewall/connection/print detail

NAT is selected on the first packet and remembered by connection tracking. Existing sessions can keep the old mapping after a rule edit. End the test session and remove only its identified tracked connection, or wait for expiry. Clearing the entire table interrupts other users, so reserve that for a planned change.

Test the service locally first, then from an allowed external source using the external port. Confirm the server’s default gateway and host firewall. A private or 100.64.0.0/10 WAN address can indicate upstream NAT; a router rule cannot open an ISP’s CGNAT mapping.

Forward-chain policy · Service ports · Recognize shared address space