Assuming you know the IP of the device you are trying to port forward to -
- Click on IP, then Firewall, then click on the NAT tab.
- Click the + sign to add a new NAT rule.
- Change Chain to dstnat.
- Click the down arrow on the far right side of the Protocol line. Click the drop-down menu that just appeared.
- Change Protocol to whatever you need. It’s usually tcp. In fact, that’s what comes up by default.
- Change Dst. Port to the port you are trying to forward. **see below for another option
- Change In. Interface to ether1-gateway or whatever you may have renamed your WAN port to (and assuming you’re using port 1 for WAN, of course…)
- Click on the Action tab.
- Change Action to dst-nat.
- Change To Addresses to the IP of the device you are trying to reach remotely (DVR, etc)
- Change To Ports to the port you need to forward.
- Click Comment and name it something that makes sense. “DVR port forwarding”, etc.
- Click OK in the New NAT Rule window you’ve been working in.
- That’s it. Test it out.
** Depending on what you’re trying to do, you can also change the incoming port to something than the internal port. For example, let’s say you want to set up an ssh connection to something on the internal network. Every hacker in the world knows that ssh uses port 22 by default. Leaving a common port like 22 open probably isn’t a good idea. You could change what port you forward and still reach a device at port 22 internally. You would change step #5 to use a different port like 12345, then in step #11 you would use port 22. Now you the Mikrotik will take traffic coming in to port 12345 and send it to port 22 at the IP address you entered in step #10.
Let’s use the example of forwarding port 12345 to 192.168.88.150
add action=dst-nat chain=dstnat comment="my port forwarding rule" disabled=no \ dst-port=12345 in-interface=ether1-gateway protocol=tcp to-addresses=\ 192.168.88.150 to-ports=12345
(the slash (backslash?) just signifies to the router that the next line is a continuation of the current line… it sees those three lines as one single entry)