MikroTik Port Forwarding & NAT Guide: Host Servers Behind Your Router

You've got a web server, a Minecraft server, or a security camera sitting behind your MikroTik router – and nobody on the internet can reach it. That's NAT doing its job. But sometimes you want the outside world to connect to something on your LAN. That's where port forwarding comes in.

This guide covers everything from basic single-port forwarding to advanced scenarios like hairpin NAT, 1:1 NAT with netmap, and managing multiple public IPs. Every step includes both CLI commands and WinBox paths so you can follow along however you prefer. If you haven't set up your router yet, start with our beginner's MikroTik setup guide first.

What Is NAT and Why You Need Port Forwarding

NAT (Network Address Translation) lets multiple devices on your LAN share a single public IP address. When your PC browses the web, the router replaces the private source IP (e.g., 192.168.88.10) with its public IP before sending packets to the internet. Replies come back to the router, which translates them back to the private IP. This is called source NAT (srcnat) – and MikroTik calls it masquerade.

But NAT is a one-way door by default. If someone on the internet tries to connect to your public IP on port 80, the router doesn't know which internal device should receive the traffic. Port forwarding (destination NAT, or dstnat) tells the router: "When traffic arrives on port 80, send it to 192.168.88.50."

Without port forwarding, you can't host anything behind your router – no web servers, no game servers, no remote desktop, nothing. With it, you open precisely the doors you need.

Prerequisites

• A MikroTik router with RouterOS v6 or v7 and internet connectivity configured.
• WinBox, WebFig, or SSH/terminal access.
• A public IP address from your ISP (static preferred; dynamic works but requires DDNS).
• The internal server's IP address must be static – either configured manually or reserved via DHCP static lease.
• A basic firewall in place – see our MikroTik firewall basics guide.

How dst-nat Rules Work

Port forwarding on MikroTik lives under IP → Firewall → NAT. Each rule specifies:

• Chain: dstnat – this chain handles traffic arriving at the router's public IP.
• Protocol: TCP, UDP, or both.
• Dst. Port: The external port the traffic is hitting (e.g., 80).
• In. Interface: Your WAN interface (e.g., ether1 or pppoe-out1).
• Action: dst-nat – redirect the traffic.
• To Addresses: The internal server's IP.
• To Ports: The port on the internal server (can differ from the external port).

The packet flow is: Internet → Router public IP:port → NAT rewrites destination → Internal server IP:port. The router also needs a srcnat masquerade rule (which you should already have from your initial setup) so return traffic routes correctly.

Step 1: Basic Port Forward – Web Server on Port 80

Let's start with the most common scenario: you have a web server at 192.168.88.50 and want people on the internet to reach it via your public IP on port 80.

CLI

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50 to-ports=80 comment="Port forward HTTP to web server"

WinBox

1. Go to IP → Firewall → NAT tab.
2. Click + (Add New).
3. General tab: Chain = dstnat, Protocol = tcp, Dst. Port = 80, In. Interface = ether1.
4. Action tab: Action = dst-nat, To Addresses = 192.168.88.50, To Ports = 80.
5. Click OK.

Important: If you have a firewall forward chain with a default drop rule (and you should – see our firewall guide), you also need to allow this forwarded traffic:

/ip firewall filter add chain=forward in-interface=ether1 protocol=tcp dst-port=80 dst-address=192.168.88.50 action=accept comment="Allow HTTP to web server" place-before=[find where comment="Drop all other forward"]

Step 2: Forwarding Multiple Ports

Most real-world setups need more than one port forward. Here's how to handle common services.

Web Server (HTTP + HTTPS)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80,443 action=dst-nat to-addresses=192.168.88.50 to-ports=80-443 comment="HTTP + HTTPS to web server"

SSH to a Linux Server

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=2222 action=dst-nat to-addresses=192.168.88.51 to-ports=22 comment="SSH (external 2222) to Linux server"

Notice we're using external port 2222 but forwarding to internal port 22. This is called port translation – more on that next.

Game Server (Minecraft)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=25565 action=dst-nat to-addresses=192.168.88.52 to-ports=25565 comment="Minecraft server"

IP Camera (RTSP)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=554 action=dst-nat to-addresses=192.168.88.53 to-ports=554 comment="RTSP to IP camera"

WinBox Path (All)

Same as Step 1 – IP → Firewall → NAT → Add. Change the protocol, ports, and target address for each service. Don't forget corresponding firewall filter rules for each forward.

Step 3: Changing Port Numbers (Port Translation)

Sometimes you don't want to expose the real internal port. Maybe port 80 is taken by another service, or you want to obscure the default port for security. MikroTik makes this easy – just set different values for dst-port (external) and to-ports (internal).

Example: External 8080 → Internal 80

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=8080 action=dst-nat to-addresses=192.168.88.50 to-ports=80 comment="External 8080 to internal web server 80"

Example: External 3390 → Internal 3389 (RDP)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=3390 action=dst-nat to-addresses=192.168.88.54 to-ports=3389 comment="External 3390 to RDP on 3389"

Multiple RDP Servers on Different External Ports

If you have three Windows machines that all run RDP on port 3389, use different external ports:

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=3389 action=dst-nat to-addresses=192.168.88.54 to-ports=3389 comment="RDP - PC1"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=3390 action=dst-nat to-addresses=192.168.88.55 to-ports=3389 comment="RDP - PC2"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=3391 action=dst-nat to-addresses=192.168.88.56 to-ports=3389 comment="RDP - PC3"

From outside, users connect to your-public-ip:3389, :3390, or :3391 – each reaching a different PC.

Step 4: Hairpin NAT / NAT Reflection

Here's a scenario that trips up almost everyone: you set up port forwarding, it works perfectly from the internet, but when you try to access the same service from inside your LAN using the public IP, it doesn't work. Classic.

Why it breaks: When a LAN client (e.g., 192.168.88.20) sends a packet to the public IP, the router does dst-nat and forwards it to the internal server (192.168.88.50). But the server sees the source as 192.168.88.20 – a local address – and replies directly to 192.168.88.20 without going through the router. The client is confused because the reply comes from a different IP than it expected.

The fix: Add a second NAT rule that also changes the source address for internal-to-internal traffic so the reply goes back through the router.

CLI – Hairpin NAT Rule

/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.50 protocol=tcp dst-port=80 out-interface=bridge-local action=masquerade comment="Hairpin NAT for web server"

WinBox

1. Go to IP → Firewall → NAT → Add New.
2. General tab: Chain = srcnat, Src. Address = 192.168.88.0/24, Dst. Address = 192.168.88.50, Protocol = tcp, Dst. Port = 80.
3. Advanced tab: Out. Interface = bridge-local (or your LAN bridge).
4. Action tab: Action = masquerade.
5. Click OK.

Now LAN clients can access http://your-public-ip and reach the internal web server. You need a separate hairpin rule for each port-forwarded service you want accessible from inside the LAN.

Alternative: Use DNS Instead

A cleaner solution is to set up split DNS. Configure your router's DNS to resolve your domain (e.g., myserver.example.com) to the internal IP 192.168.88.50 for LAN clients, while external DNS resolves it to the public IP. This avoids hairpin NAT entirely:

/ip dns static add name=myserver.example.com address=192.168.88.50 comment="Internal DNS for web server"

Step 5: 1:1 NAT Using Netmap

If you have a spare public IP and want to map it entirely to one internal server – all ports, all protocols – use netmap. This is called 1:1 NAT and it's common for DMZ servers, mail servers, or any device that needs full inbound connectivity.

Scenario

Your ISP gave you a /29 block: 203.0.113.0/29. Your router uses 203.0.113.1 as the WAN IP. You want 203.0.113.2 to map entirely to 192.168.88.50.

Step 5.1: Add the Public IP to Your WAN Interface

/ip address add address=203.0.113.2/29 interface=ether1 comment="Additional public IP for web server"

Step 5.2: Destination NAT (Inbound – All Traffic to Internal Server)

/ip firewall nat add chain=dstnat dst-address=203.0.113.2 action=netmap to-addresses=192.168.88.50 comment="1:1 NAT inbound - 203.0.113.2 to 192.168.88.50"

Step 5.3: Source NAT (Outbound – Internal Server Uses the Public IP)

/ip firewall nat add chain=srcnat src-address=192.168.88.50 action=src-nat to-addresses=203.0.113.2 comment="1:1 NAT outbound - 192.168.88.50 uses 203.0.113.2"

WinBox

1. IP → Addresses → Add 203.0.113.2/29 on ether1.
2. IP → Firewall → NAT → Add two rules as above (dstnat with netmap, srcnat with src-nat).

Now 192.168.88.50 is fully reachable on 203.0.113.2 – every port, every protocol. Be very careful with security – make sure the server has its own firewall, or add specific firewall filter rules on the router to restrict access.

Step 6: Multiple Public IPs with Different NAT Rules

If your ISP provides multiple public IPs, you can assign different services to different IPs. This keeps things organized and lets you apply separate firewall policies per IP.

Example Setup

CLI

# Add public IPs to WAN interface
/ip address add address=203.0.113.2/29 interface=ether1
/ip address add address=203.0.113.3/29 interface=ether1
/ip address add address=203.0.113.4/29 interface=ether1

# Web server
/ip firewall nat add chain=dstnat dst-address=203.0.113.2 protocol=tcp dst-port=80,443 action=dst-nat to-addresses=192.168.88.50 comment="Web server on .2"
/ip firewall nat add chain=srcnat src-address=192.168.88.50 action=src-nat to-addresses=203.0.113.2 comment="Web server outbound uses .2"

# Mail server
/ip firewall nat add chain=dstnat dst-address=203.0.113.3 protocol=tcp dst-port=25,587,993 action=dst-nat to-addresses=192.168.88.60 comment="Mail server on .3"
/ip firewall nat add chain=srcnat src-address=192.168.88.60 action=src-nat to-addresses=203.0.113.3 comment="Mail server outbound uses .3"

# Game server (full 1:1 NAT)
/ip firewall nat add chain=dstnat dst-address=203.0.113.4 action=netmap to-addresses=192.168.88.70 comment="Game server 1:1 NAT on .4"
/ip firewall nat add chain=srcnat src-address=192.168.88.70 action=src-nat to-addresses=203.0.113.4 comment="Game server outbound uses .4"

Step 7: Security – Only Forward What You Need

Every forwarded port is an open door into your network. Treat port forwarding like handing out house keys – be deliberate about who gets one.

Security Best Practices

• Forward the minimum ports necessary. Don't forward all ports to a server unless you have a very good reason (and strong server-side security).
• Use port translation to hide default ports. Running SSH on external port 2222 won't stop a determined attacker, but it eliminates 99% of automated bots scanning port 22.
• Restrict source IPs when possible. If only your office needs RDP, add src-address=YOUR.OFFICE.IP to the NAT rule.
• Always pair NAT rules with firewall filter rules. The NAT rule redirects traffic; the filter rule decides whether to actually allow it.
• Keep your internal servers patched. A forwarded port is only as safe as the application listening on it.
• Use VPN instead of port forwarding for management protocols like RDP, SSH, and WinBox. Set up a WireGuard VPN and access services securely without exposing them to the internet.

Example: Restrict RDP to a Specific Source IP

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=3389 src-address=198.51.100.10 action=dst-nat to-addresses=192.168.88.54 to-ports=3389 comment="RDP only from office IP"

Example: Firewall Filter to Complement NAT

# Allow only the forwarded traffic
/ip firewall filter add chain=forward in-interface=ether1 protocol=tcp dst-port=80 dst-address=192.168.88.50 action=accept comment="Allow forwarded HTTP"
/ip firewall filter add chain=forward in-interface=ether1 protocol=tcp dst-port=443 dst-address=192.168.88.50 action=accept comment="Allow forwarded HTTPS"

# The default drop rule catches everything else
# /ip firewall filter add chain=forward action=drop comment="Drop all other forward"

For a full firewall walkthrough, read our MikroTik firewall basics guide.

Common Port Forwarding Examples (Copy-Paste Ready)

Here are the most-requested port forwarding scenarios. Replace ether1 with your WAN interface and adjust internal IPs.

Web Server (HTTP + HTTPS)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50 to-ports=80 comment="HTTP to web server"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=443 action=dst-nat to-addresses=192.168.88.50 to-ports=443 comment="HTTPS to web server"

Minecraft Server (Java Edition)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=25565 action=dst-nat to-addresses=192.168.88.52 to-ports=25565 comment="Minecraft Java"

Minecraft Bedrock Edition

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=udp dst-port=19132 action=dst-nat to-addresses=192.168.88.52 to-ports=19132 comment="Minecraft Bedrock"

Remote Desktop (RDP)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=3389 action=dst-nat to-addresses=192.168.88.54 to-ports=3389 comment="RDP to Windows PC"

IP Camera (RTSP + Web Interface)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=554 action=dst-nat to-addresses=192.168.88.53 to-ports=554 comment="RTSP to IP camera"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=8081 action=dst-nat to-addresses=192.168.88.53 to-ports=80 comment="Camera web UI on 8081"

FTP Server (Active + Passive)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=21 action=dst-nat to-addresses=192.168.88.55 to-ports=21 comment="FTP control"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=50000-50100 action=dst-nat to-addresses=192.168.88.55 to-ports=50000-50100 comment="FTP passive range"

Note: FTP passive mode requires a range of ports. Configure your FTP server to use the same passive port range (50000–50100 in this example).

Mail Server (SMTP + IMAP + Submission)

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=25 action=dst-nat to-addresses=192.168.88.60 to-ports=25 comment="SMTP"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=587 action=dst-nat to-addresses=192.168.88.60 to-ports=587 comment="SMTP submission"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=993 action=dst-nat to-addresses=192.168.88.60 to-ports=993 comment="IMAPS"

Plex Media Server

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=32400 action=dst-nat to-addresses=192.168.88.57 to-ports=32400 comment="Plex Media Server"

OpenVPN Server

/ip firewall nat add chain=dstnat in-interface=ether1 protocol=udp dst-port=1194 action=dst-nat to-addresses=192.168.88.58 to-ports=1194 comment="OpenVPN"

Complete Copy-Paste Script: Common Home/Office Setup

This script forwards a web server, a Minecraft server, and enables hairpin NAT for the web server. Adjust IPs and interfaces to match your network.

# === Port Forwarding Rules ===
# Web server - HTTP and HTTPS
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50 to-ports=80 comment="HTTP to web server"
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=443 action=dst-nat to-addresses=192.168.88.50 to-ports=443 comment="HTTPS to web server"

# Minecraft Java Edition
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=25565 action=dst-nat to-addresses=192.168.88.52 to-ports=25565 comment="Minecraft Java"

# === Hairpin NAT for Web Server ===
/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.50 protocol=tcp dst-port=80 out-interface=bridge-local action=masquerade comment="Hairpin HTTP"
/ip firewall nat add chain=srcnat src-address=192.168.88.0/24 dst-address=192.168.88.50 protocol=tcp dst-port=443 out-interface=bridge-local action=masquerade comment="Hairpin HTTPS"

# === Firewall Filter Rules (place before your default drop rule) ===
/ip firewall filter add chain=forward in-interface=ether1 protocol=tcp dst-port=80 dst-address=192.168.88.50 action=accept comment="Allow HTTP forward"
/ip firewall filter add chain=forward in-interface=ether1 protocol=tcp dst-port=443 dst-address=192.168.88.50 action=accept comment="Allow HTTPS forward"
/ip firewall filter add chain=forward in-interface=ether1 protocol=tcp dst-port=25565 dst-address=192.168.88.52 action=accept comment="Allow Minecraft forward"

Complete Copy-Paste Script: ISP / Multi-Server Setup

For ISPs or hosting environments with multiple public IPs and 1:1 NAT:

# === Add Public IPs to WAN ===
/ip address add address=203.0.113.2/29 interface=ether1 comment="Public IP - Web server"
/ip address add address=203.0.113.3/29 interface=ether1 comment="Public IP - Mail server"

# === 1:1 NAT - Web Server ===
/ip firewall nat add chain=dstnat dst-address=203.0.113.2 action=netmap to-addresses=192.168.88.50 comment="1:1 inbound web server"
/ip firewall nat add chain=srcnat src-address=192.168.88.50 action=src-nat to-addresses=203.0.113.2 comment="1:1 outbound web server"

# === 1:1 NAT - Mail Server ===
/ip firewall nat add chain=dstnat dst-address=203.0.113.3 action=netmap to-addresses=192.168.88.60 comment="1:1 inbound mail server"
/ip firewall nat add chain=srcnat src-address=192.168.88.60 action=src-nat to-addresses=203.0.113.3 comment="1:1 outbound mail server"

# === Firewall - only allow specific ports to servers ===
/ip firewall filter add chain=forward dst-address=192.168.88.50 protocol=tcp dst-port=80,443 action=accept comment="Allow HTTP/HTTPS to web server"
/ip firewall filter add chain=forward dst-address=192.168.88.60 protocol=tcp dst-port=25,587,993 action=accept comment="Allow mail ports to mail server"

Troubleshooting: Port Forward Not Working

Port forwarding not working is one of the most common MikroTik support questions. Walk through this checklist systematically.

1. Check Your NAT Rules

/ip firewall nat print where chain=dstnat

Verify the rule exists, is enabled (no X flag), and has the correct interface, protocol, ports, and target IP. Check the counters – are packets hitting the rule?

2. Check Your Firewall Filter Rules

/ip firewall filter print where chain=forward

If you have a default-drop forward chain (you should!), make sure there's an accept rule for the forwarded traffic above the drop rule. This is the #1 cause of "NAT is correct but nothing gets through."

3. Verify the Internal Server

• Is the server running? Can you access it from another LAN device?
• Is the server listening on the correct port? (netstat -tlnp on Linux, netstat -an on Windows)
• Does the server have a firewall of its own? Windows Defender Firewall blocks inbound connections by default.
• Is the server's default gateway set to the MikroTik router? If not, replies go to the wrong place.

4. Double NAT

This is extremely common. If your MikroTik is behind another router (ISP modem, ONT with built-in router), you have double NAT. Your port forward on MikroTik is correct, but the upstream router doesn't know to forward traffic to the MikroTik.

Solutions:

• Bridge mode: Put the ISP modem/router into bridge mode so your MikroTik gets the public IP directly.
• DMZ on ISP router: Set the MikroTik's IP as the DMZ host on the ISP router (forwards all ports).
• Port forward on both: Forward the same port on the ISP router to MikroTik's WAN IP, then on MikroTik to the server. Ugly but works.

To check if you're behind double NAT, compare your MikroTik WAN IP (/ip address print where interface=ether1) with your actual public IP (visit whatismyip.com from behind the router). If they differ, you're behind another NAT.

5. ISP Blocking Ports

Many ISPs block common inbound ports – especially port 25 (SMTP), port 80 (HTTP), and port 443 (HTTPS) on residential connections. Some even block all inbound traffic (CGNAT – Carrier Grade NAT).

How to check:

• If your WAN IP starts with 100.64.x.x or 10.x.x.x, you're behind CGNAT. Port forwarding is impossible without your ISP assigning you a real public IP.
• Try using a non-standard port (e.g., 8080 instead of 80). If that works, the ISP is blocking the standard port.
• Call your ISP and ask if they block inbound connections or use CGNAT.

Workarounds for CGNAT:

• Request a public IP from your ISP (sometimes available for a small fee).
• Use a reverse proxy or tunnel service (Cloudflare Tunnel, ngrok).
• Set up a ZeroTier VPN on MikroTik to bypass CGNAT entirely.

6. Wrong In-Interface

If your internet connection uses PPPoE, your WAN interface is pppoe-out1 (not ether1). Set in-interface=pppoe-out1 in your NAT rules.

/ip firewall nat add chain=dstnat in-interface=pppoe-out1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50 to-ports=80 comment="HTTP forward (PPPoE)"

7. Use Packet Sniffer to Debug

If you're still stuck, watch what the router is actually doing with inbound packets:

/tool sniffer quick port=80 interface=ether1

Or use torch for a live view:

/tool torch interface=ether1 port=80

If packets arrive on ether1 but never appear on the LAN interface, the firewall is dropping them. If they never arrive at all, the issue is upstream (ISP or double NAT).

Verifying with External Port Checker Tools

Once your rules are in place, verify from outside your network:

• YouGetSignal Open Port Check – Enter your public IP and port number.
• CanYouSeeMe.org – Quick open port test.
• GRC ShieldsUp – Tests all common ports and gives a security report.
• From your phone (off WiFi): Disconnect from your LAN WiFi, use mobile data, and try to connect to your public IP on the forwarded port.
• nmap from a remote server: nmap -Pn -p 80 YOUR_PUBLIC_IP

If the port shows as open, your forwarding is working. If it shows closed, the service isn't listening. If it shows filtered, a firewall (yours or your ISP's) is blocking it.

Port Forwarding with ISP Connections (PPPoE, LTE, Dual WAN)

A few important notes for special WAN setups:

PPPoE

Use in-interface=pppoe-out1 in all your dstnat rules. The physical ether1 won't work because the public IP is on the PPPoE interface. For a full PPPoE setup, see our PPPoE server guide.

LTE / Mobile

Most LTE connections use CGNAT – port forwarding won't work. Check our MikroTik LTE setup guide for details. If you have a public IP on LTE, use in-interface=lte1.

Dual WAN / Failover

With dual WAN, create separate dstnat rules for each WAN interface. If you failover to a backup WAN, the port forward only works on whichever WAN has the active public IP.

Bonus: Automate Port Forward Management with Scripts

If you frequently add or remove port forwards (e.g., for temporary game servers), you can use MikroTik's scripting and scheduler to automate it. Here's a script that enables a Minecraft port forward on Friday evenings and disables it Monday morning:

# Create the NAT rule (disabled by default)
/ip firewall nat add chain=dstnat in-interface=ether1 protocol=tcp dst-port=25565 action=dst-nat to-addresses=192.168.88.52 to-ports=25565 comment="Minecraft - scheduled" disabled=yes

# Scheduler: Enable on Friday at 6 PM
/system scheduler add name=minecraft-on on-event="/ip firewall nat enable [find where comment=\\\"Minecraft - scheduled\\\"]" start-time=18:00:00 interval=7d start-date=2026-07-10

# Scheduler: Disable on Monday at 8 AM
/system scheduler add name=minecraft-off on-event="/ip firewall nat disable [find where comment=\\\"Minecraft - scheduled\\\"]" start-time=08:00:00 interval=7d start-date=2026-07-13

MikroRadius and Port Forwarding

If you're running a hotspot or PPPoE server for an ISP or hospitality business, MikroRadius handles all the user management, billing, and bandwidth control – while your port forwarding rules handle server access. They complement each other perfectly: MikroRadius manages your subscribers, port forwarding exposes your services. The NAT rules on the router don't interfere with RADIUS authentication – they operate on different chains and at different levels of the network stack.

Troubleshooting Quick Reference

Conclusion

Port forwarding on MikroTik is powerful and flexible – from simple single-port dst-nat rules to full 1:1 NAT with netmap across multiple public IPs. The key principles are simple:

1. Create the NAT rule (chain=dstnat) to redirect traffic.
2. Create a matching firewall filter rule to allow the forwarded traffic.
3. Add hairpin NAT if you need to access the service from inside your LAN.
4. Forward only what you need and restrict by source IP when possible.
5. Verify from outside using port checker tools or mobile data.

If you're just getting started with MikroTik, grab our beginner's setup guide and firewall basics tutorial first – they lay the foundation for everything in this guide. And if you're running a public WiFi or ISP network, MikroRadius takes the pain out of user management so you can focus on the network itself.

Happy forwarding – and remember, every open port is a responsibility. Keep it tight. 🔒