Skip to main content
ICInfraCalc
IDEN

MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator

Expose internal server/NVR ports to the public internet (DST-NAT) and eliminate local loopback timeouts using Hairpin NAT.

Input Parameters

Try Example:

Calculation Results

wanIface
ether1-ISP
pubIp
203.142.77.10
extPort
8000
intIp
192.168.88.250
intPort
8000
proto
tcp
lanCidr
192.168.88.0/24
desc
NVR-CCTV-Server
enableHairpin
true
enableFilterRule
true
dstNatRule
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"
hairpinNatRule
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"
filterAcceptRule
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"
RouterOS Script
# =====================================================================
# InfraCalc.id - Port Forwarding (DST-NAT) + Hairpin NAT (NVR-CCTV-Server)
# Target: 203.142.77.10:8000 -> 192.168.88.250:8000 [TCP]
# =====================================================================

/ip firewall nat
# 1. DST-NAT: Arahkan trafik dari IP Publik / WAN ke IP Server Lokal
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"

# 2. HAIRPIN NAT: Agar saat staf di jaringan lokal (192.168.88.0/24) mengakses IP Publik/Domain, tidak mental/timeout
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"

# 3. FIREWALL FILTER: Izinkan trafik forward hasil DST-NAT melewati firewall
/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"

How to Use This Tool

  1. Enter your public IP (or select your WAN interface), external internet-facing port, and the target internal server IP and port.
  2. Select the transport protocol (TCP, UDP, or Both), define your local LAN subnet CIDR (e.g. 192.168.88.0/24), and provide a descriptive label.
  3. Review the generated Destination NAT, Hairpin NAT loopback, and firewall filter rules, then copy the script into your MikroTik RouterOS terminal.

Worked Example: CCTV NVR Camera Port 8000

Computed example: Forwarding external port 8000 (TCP) at public IP 203.142.77.10 to internal host 192.168.88.250:8000 (NVR-CCTV-Server) alongside a Hairpin NAT loopback rule for LAN subnet 192.168.88.0/24.

Example Input
{
  "desc": "NVR-CCTV-Server",
  "pubIp": "203.142.77.10",
  "extPort": "8000",
  "intIp": "192.168.88.250",
  "intPort": "8000",
  "proto": "tcp",
  "lanCidr": "192.168.88.0/24",
  "wanIface": "ether1-ISP"
}
Calculated Output
wanIface:
ether1-ISP
pubIp:
203.142.77.10
extPort:
8000
intIp:
192.168.88.250
intPort:
8000
proto:
tcp
lanCidr:
192.168.88.0/24
desc:
NVR-CCTV-Server
enableHairpin:
true
enableFilterRule:
true
dstNatRule:
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"
hairpinNatRule:
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"
filterAcceptRule:
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"

Core Concept & Engineering Notes

Destination NAT (DST-NAT), commonly known as Port Forwarding, directs unsolicited incoming traffic from an external public IP address or WAN interface to a specific private IPv4 host located inside a local area network, such as a web server, internal database, Remote Desktop (RDP) workstation, or Network Video Recorder (NVR). Because RFC 1918 private address ranges cannot be routed across the public internet, the edge router must rewrite incoming packet headers to reach the intended local service. The most frequent operational dilemma encountered with port forwarding is local loopback failure, resolved by Hairpin NAT (also called NAT Reflection or NAT Loopback). When an internal employee inside the office attempts to access an in-house server using its external domain name or public IP, the client transmits packets toward the router's WAN address. The router performs destination NAT and forwards the packets to the internal server. However, because the server observes that the source IP belongs to its own local LAN subnet, it sends reply packets directly back to the workstation through the Layer 2 switch, bypassing the router entirely. The client rejects these incoming packets because it expects an acknowledgment from the public IP address, causing the connection to immediately time out. Hairpin NAT resolves this asymmetric routing breakdown by applying a localized Source NAT (masquerade) rule to inbound LAN-originated traffic directed at the server's private address. By rewriting the client's source IP to the router's local gateway address, the server is forced to route reply packets back through the router. The router translates the source IP back to the expected public address before returning it to the client, guaranteeing seamless access from both the internet and the local office network.

How It Was Calculated (Formulas & Steps)

Frequently Asked Questions (FAQ)

Why is my CCTV or internal server accessible from the internet but times out when connected to office Wi-Fi?

This is the classic symptom of missing Hairpin NAT. Internal clients reach out to the router's public IP; the local server replies directly over the local switch, which the client drops because the replying source IP does not match the public IP it contacted.

Do I need to specify a static Public IP if my router uses dynamic PPPoE or DHCP client?

If your public IP is dynamic, you can substitute the `dst-address` match condition with `in-interface=ether1-ISP` or `in-interface=pppoe-out1` in your RouterOS DST-NAT configuration rule.

Can the external public port differ from the internal server port?

Yes. Port translation allows you to expose public port 8080 on the WAN while mapping it to standard port 80 on your internal local web server.

Is port forwarding secure against internet attacks?

Any forwarded port is visible to public internet automated scanners. We strongly recommend changing well-known default ports (e.g. moving RDP 3389 to a high random port), using strong credentials, or accessing sensitive servers through a WireGuard VPN instead.

Related Calculators

MikroTik Multi-WAN PCC Load Balance Calculator

Multi-WAN (2–5 ISP) proportional PCC load balancing and recursive failover configuration script generator for RouterOS v7.

MikroTik Bandwidth Calculator (Simple Queue, Burst, PCQ, FQ-CoDel)

Calculate Limit-At (CIR), Max-Limit (MIR), Burst, PCQ, and FQ-CoDel for RouterOS v7 with automated configuration script generation.

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

References & Notes

Last updated: Content Status: Draft (Pending Editorial Review)

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.