The official Mikrotik router thread

You need "hairpin NAT". There's a few pages/videos out there but the exact setup comes down to your particular settings.

You basically need a rule to masquerade any packets with a destination of your external IP, but coming from the internal interface. You then need another rule (filtered to the port it would be trying to connect on) to mangle that and set the source as the internal router IP and the destination as the CCTV IP. You need a rule for each port that you forward to mangle it to the right destination.

Note that for dynamic IPs you can add hostnames to address lists. If you do that with the "mynetname" hostname from Mikrotik you have an address list that always resolves to your external IP to be used by that first rule.
 
InternetLuddite said:
I have a device on the LAN, CCTV. I have a rule that allows incoming traffic to CCTV which works.

I connect to CCTV using dyndns name on my apps. Problem is when I am inside the network, it doesn't work. The IP is being resolved as the external IP of the router ..
Click to expand...

I'm lazy so I just set a static DNS entry in the Mikrotik that resolves the dyndns name to the local address
 
mister said:
I'm lazy so I just set a static DNS entry in the Mikrotik that resolves the dyndns name to the local address
Click to expand...
That can work as long as you use the same ports. I prefer to use the default ports for the devices "internally" then pick a random one from outside to forward.
 
Would appreciate if someone could provide screenshot of said configuration using web console. I have restricted access to my router which is managed by Vox telecom so I cant use CLI
Edit: most stuff I find on net show CLI commands but I cant use that facility
 
rorz0r said:
You need "hairpin NAT". There's a few pages/videos out there but the exact setup comes down to your particular settings.

You basically need a rule to masquerade any packets with a destination of your external IP, but coming from the internal interface. You then need another rule (filtered to the port it would be trying to connect on) to mangle that and set the source as the internal router IP and the destination as the CCTV IP. You need a rule for each port that you forward to mangle it to the right destination.

Note that for dynamic IPs you can add hostnames to address lists. If you do that with the "mynetname" hostname from Mikrotik you have an address list that always resolves to your external IP to be used by that first rule.
Click to expand...
InternetLuddite said:
Would appreciate if someone could provide screenshot of said configuration using web console. I have restricted access to my router which is managed by Vox telecom so I cant use CLI
Edit: most stuff I find on net show CLI commands but I cant use that facility
Click to expand...
DWPTA said:
Which config?
Click to expand...
For this
 
InternetLuddite said:
/subbed

Have a question? Is there a basic guide on how to do NAT / PAT .

I have a device on the LAN, CCTV. I have a rule that allows incoming traffic to CCTV which works.

I connect to CCTV using dyndns name on my apps. Problem is when I am inside the network, it doesn't work. The IP is being resolved as the external IP of the router ..

I think it doesn't like seeing the traffic coming from inside to go out and then coming back in.

Don't know how to fix this :(
Click to expand...

First: IP > Cloud > Enable. Free DNS service that all mikrotiks have.
Second: /ip firewall nat add action=masquerade chain=srcnat disabled=yes out-interface=all-ethernet

Masquerading your ethernet interfaces will allow connections to exit and enter your network again without a hairpin NAT.
 
The ubiquity edgerouter x makes it easy to block certain types of traffic like YouTube for eg
 
I have a mikrotik with custom firmware. (or RouterOS, I think it is a custom routerOS)

How do I remove it?
I tried netinstall, but the device does not pick up, I suspect they blocked it. I also cannot upgrade from within winbox they seem to override it.
 
McGuywer said:
@Thor,

As far as I am aware, I do not think it is possible to load a custom RouterOS.
RouterOS is developed by MikroTik.

If you cannot upgrade, make sure your router isn't hacked.
Check the user you are logging in with, does it have full access?

Here is a Wiki entry that could help you to upgrade:
https://wiki.mikrotik.com/wiki/Manual:Upgrading_RouterOS
Click to expand...
You can we've done it before.

In this case it's a bunch of Mikrotiks I bought of Alibaba.

When I open the terminal you know where it has the Mikrotik text logo?

It says Shenzhen Electric in Text.
 
Most probably it just changing the logo:

You could use this if you u want something to be displayed after a user has logged in... eg a company logo or contact info..

/system note edit note

Type anything you want there... You can even use fancy ASCII graphics..
Click to expand...

From
https://forum.mikrotik.com/viewtopic.php?t=19993#p95602

So nothing strange.

Do you mind answering my question regarding the user rights?
 
It is not. this is custom firmware.

system note does not change the name of routerOS to SenzhenOS
McGuywer said:
Most probably it just changing the logo:



From
https://forum.mikrotik.com/viewtopic.php?t=19993#p95602

So nothing strange.

Do you mind answering my question regarding the user rights?
Click to expand...

Code: 
[admin@Shenzhen] > user print
Flags: X - disabled
 #   NAME              GROUP              ADDRESS            LAST-LOGGED-IN     
 0   ;;; system default user
     admin             full                                  jan/02/1970 00:36:42
 
Last edited:
Thor said:
It is not. this is custom firmware.

system note does not change the name of routerOS to SenzhenOS


Code: 
[admin@Shenzhen] > user print
Flags: X - disabled
#   NAME              GROUP              ADDRESS            LAST-LOGGED-IN    
0   ;;; system default user
     admin             full                                  jan/02/1970 00:36:42
Click to expand...
Sure, but this will:
/system identity set name=SenzhenOS
 
McGuywer said:
Sure, but this will:
/system identity set name=SenzhenOS
Click to expand...
No, that won't.

I am not talking about the identity.
I am talking about this:
download.png

I do not have the device with me atm, but that ^ is Senzhen Electric and then it is Senzhen Electric SenzhenOS 6.40 www.alibaba.com

That is custom firmware and not some system edit.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X