/ip firewall nat → dst-nat planner

MikroTik Port Forwarding Generator

Generate a narrow dst-nat rule, the matching forward-chain allow rule, and an optional Hairpin NAT rule. The page also checks whether the WAN address looks like provider CGNAT.

Written by Diaa · Last reviewed 21 September 2026 · RouterOS v7 focus
Important limitation: a browser cannot prove that an inbound port is reachable from the public internet. This tool generates and explains the router rules; test from a different network or an external probe after deployment.

1. Forwarding inputs

The interface receiving the public request.

Used for optional Hairpin NAT.

A single port or range such as 5000-5010.

Restrict exposure when only one office, VPN, or monitoring source needs access.

If it is in 100.64.0.0/10, the tool warns that inbound forwarding will not work directly through provider CGNAT.

port-forwarding.rsc
Enter the internal service details to build the rules.


What the generated rules do
The dst-nat rule changes the destination from the router's public address and external port to the private server and internal port. The filter rule is separate: NAT chooses the destination, while the forward chain decides whether the packet may cross the router. Keeping both rules visible makes the change easier to review and roll back.
/ip firewall nat
add chain=dstnat in-interface=ether1 protocol=tcp dst-port=443 action=dst-nat to-addresses=192.168.88.10 to-ports=443

/ip firewall filter
add chain=forward in-interface=ether1 connection-nat-state=dstnat protocol=tcp dst-address=192.168.88.10 dst-port=443 action=accept
Hairpin NAT explained
Hairpin NAT, also called NAT loopback, is needed when a client on the same LAN reaches an internal server through the router's public address. The destination is translated correctly, but without a matching source translation the server may reply directly to the LAN client. The client then sees a reply from the private address instead of the public address it requested and drops it.
CGNAT check
When the WAN address is inside 100.64.0.0/10, the provider is usually sharing a public address through Carrier-Grade NAT. A dst-nat rule on your router cannot receive an unsolicited connection that never reaches your router. Use a public IPv4 address, a provider port-forwarding service, or a WireGuard tunnel to a reachable VPS instead.
Safe test sequence
  1. Confirm the internal service works from the LAN using its private address.
  2. Apply the generated rules with a local or out-of-band management path available.
  3. Test from a mobile network or another independent ISP, not from the same LAN.
  4. Check rule counters and the server logs. A zero counter means the request did not reach the rule.
  5. Remove the rule when the service is no longer needed and restrict source addresses whenever possible.
Security rule: never forward Winbox, Telnet, FTP, API, or an unprotected management panel to the public internet. Use WireGuard for administration.
References and related tools
MikroTik's NAT documentation covers dst-nat, src-nat, and Hairpin NAT. Use the WireGuard generator when the real goal is remote administration, and the deployment checklist before applying firewall changes.
WireGuard GeneratorPrefer a VPN for management instead of exposing a port.IPv4 CalculatorVerify the internal server subnet and address range.NAT & Firewall GuideRead the reasoning behind the generated rules.