1

I have a MikroTik router set up at the entrance of our office network. I'm looking to configure it for specific domain-based port forwarding. The task seems to be rather common, but I am stuck. Here's what I need to achieve:

  • Requests to office1.example.com:443 should be redirected to Server1 on port 443.
  • Similarly, requests to office2.example.com:443 should be redirected to Server2 on port 443. How can I set up these domain-specific port forwarding rules on the MikroTik router?

Any guidance or steps to follow would be greatly appreciated.

Dmitry Nikolaev
  • 161

2 Answers2

1
  • Requests to office1.example.com:443 should be redirected to Server1 on port 443.
  • Similarly, requests to office2.example.com:443 should be redirected to Server2 on port 443. How can I set up these domain-specific port forwarding rules on the MikroTik router?

You can't. Port forwarding doesn't work that way. IP headers does not contain any information about domain names, only IP addresses.

TLS contains a Server Name Indication. That can't be done at L3 level, which is where your firewall operates. Furthermore, with encrypted SNI, the TLS connection has to be terminated to know the SNI hostname sent. You need a reverse proxy server that can terminate (and proxy) TLS connections to the destination based on the SNI.

vidarlo
  • 9,165
0

At first you have to create address list entries for your domains

/ip firewall filter add chain=forward protocol=tcp dst-address=<Server1-IP> dst-port=443 action=accept

And then create nat ruls via:

/ip firewall nat add chain=dstnat protocol=tcp dst-address-list=office1.example.com dst-port=443 action=dst-nat to-addresses=<Server1-IP> to-ports=443

Replace the information and if it works repeat for another domain too. Please double check the syntax to prevent errors.

AmirD12
  • 44
  • The IP address of the domain is resolved when the rule is added. If the IP address changes, then the firewall rules need to be reapplied. – Tero Kilkanen Dec 07 '23 at 07:48
  • Thank you for your answer. However, the first command does not work – Mikrotik does not accept it because of two 'address' parameters in a single command. But even if I overcome this with separate commands, the traffic is not redirected as expected, I see the ERR_CONNECTION_TIMED_OUT in my browser. – Dmitry Nikolaev Dec 12 '23 at 06:56
  • @DmitryNikolaev I edited my command please chek it again – AmirD12 Dec 12 '23 at 09:31