Skip to main content

MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator

Expose internal server/NVR ports to the public internet (DST-NAT) and eliminate local loopback timeouts using Hairpin NAT.

Input Parameters

Try Example:

Calculation Results

Public WAN Interface
ether1-ISP
Public IP Address (WAN)
203.142.77.10
External Port (Public)
8000
Internal Server / Device IP
192.168.88.250
Internal Port (Local)
8000
Transport Protocol
tcp
LAN Network Subnet
192.168.88.0/24
Service / Rule Description
NVR-CCTV-Server
Hairpin NAT (Loopback) Status
Yes / Active
Firewall Filter Forward Status
Yes / Active
Want to compare 2 design options side-by-side (e.g., Scenario A vs Scenario B)?
⚡ Network Reflex Speed Drill (SKKNI, MTCNA & CCNA)
Test MTCNA / CCNA skills & download stamped score certificate
⚡ Enterprise SMB Tier (150–800 Mbps)
MikroTik RB5009UG+S+IN / L009UiGS
RouterOS v7 Level 5 • Marvell Armada Quad-Core 1.4 GHz (1GB RAM)

Handles Multi-WAN PCC mangle rules and FQ-CoDel queue trees with low CPU utilization.

Port Forwarding Rule (DST-NAT)
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"
Hairpin NAT Rule (SRC-NAT Masquerade)
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"
Firewall Filter Accept Rule
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"
Terminal Configuration Script (CLI)
# =====================================================================
# InfraCalc.web.id - Port Forwarding (DST-NAT) + Hairpin NAT (NVR-CCTV-Server)
# Target: 203.142.77.10:8000 -> 192.168.88.250:8000 [TCP]
# =====================================================================

/ip firewall nat
# 1. DST-NAT: Arahkan trafik dari IP Publik / WAN ke IP Server Lokal
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"

# 2. HAIRPIN NAT: Agar saat staf di jaringan lokal (192.168.88.0/24) mengakses IP Publik/Domain, tidak mental/timeout
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"

# 3. FIREWALL FILTER: Izinkan trafik forward hasil DST-NAT melewati firewall
/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"
Multi-Vendor CLI & Packet Flow

Multi-Vendor Config Translator & Interactive Packet Flow Visualizer

Interactive Packet Flow Pipeline (Click Stage to Inspect)WAN ➔ Prerouting/NAT ➔ Filter/QoS ➔ LAN
1. WAN / LAN IngressTCP :80002. PREROUTING / DST-NATRewrite -> 192.168.88.23. Firewall Forward FilState: NEW/ESTABLISHED4. POSTROUTING / TargetServer 192.168.88.250
1. WAN / LAN Ingress: Incoming packet arrives at public port :8000 on WAN or local subnet (192.168.88.0/24).
# =====================================================================
# InfraCalc.web.id - Port Forwarding (DST-NAT) + Hairpin NAT (NVR-CCTV-Server)
# Target: 203.142.77.10:8000 -> 192.168.88.250:8000 [TCP]
# =====================================================================

/ip firewall nat
# 1. DST-NAT: Arahkan trafik dari IP Publik / WAN ke IP Server Lokal
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"

# 2. HAIRPIN NAT: Agar saat staf di jaringan lokal (192.168.88.0/24) mengakses IP Publik/Domain, tidak mental/timeout
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"

# 3. FIREWALL FILTER: Izinkan trafik forward hasil DST-NAT melewati firewall
/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"
Auto Visual Architecture

Visual Network Topology Generator (SVG / PNG)

Port Forwarding (DST-NAT) & Hairpin NAT TopologyKalkuNet.com • Auto-TopologyPublic Internet ClientTCP Port 8000 -> WAN IPLocal LAN Client (HairpiSubnet 192.168.88.0/24RTRMikroTik Firewall NATDST-NAT :8000 -> 192.168.88.250:SWLAN Switch SegmentGateway 192.168.88.0/24NVR-CCTV-Server192.168.88.250:8000 (TCP)[Port Forwarded]Other Office HostsProtected by Forward Chain[Internal LAN]
Share to WhatsApp
ℹ️

Technical Accuracy Note: Calculation results are engineering estimates based on standard RFC/IEEE/ITU-T models. Actual field performance may vary due to protocol overhead, hardware specifications, and environmental factors.

🚀 Share Calculation Results or Embed on Your Site

Deep-link automatically preserves your current inputs — ideal for WhatsApp, Telegram, Reddit, or engineering docs.

How to Use This Tool

  1. Enter your public IP (or select your WAN interface), external internet-facing port, and the target internal server IP and port.
  2. Select the transport protocol (TCP, UDP, or Both), define your local LAN subnet CIDR (e.g. 192.168.88.0/24), and provide a descriptive label.
  3. Review the generated Destination NAT, Hairpin NAT loopback, and firewall filter rules, then copy the script into your MikroTik RouterOS terminal.

Worked Example: CCTV NVR Camera Port 8000

Computed example: Forwarding external port 8000 (TCP) at public IP 203.142.77.10 to internal host 192.168.88.250:8000 (NVR-CCTV-Server) alongside a Hairpin NAT loopback rule for LAN subnet 192.168.88.0/24.

Example Input
Service / Server Description
NVR-CCTV-Server
Public WAN IP / DDNS Hostname
203.142.77.10
External Port (Public)
8000
Internal Server IP (LAN)
192.168.88.250
Internal Server Port
8000
Transport Protocol
TCP (Web, HTTP/HTTPS, SSH, RDP)
LAN Subnet (Hairpin NAT Loopback)
192.168.88.0/24
WAN Interface (ISP)
ether1-ISP
Calculated Output
Public WAN Interface
ether1-ISP
Public IP Address (WAN)
203.142.77.10
External Port (Public)
8000
Internal Server / Device IP
192.168.88.250
Internal Port (Local)
8000
Transport Protocol
tcp
LAN Network Subnet
192.168.88.0/24
Service / Rule Description
NVR-CCTV-Server
Hairpin NAT (Loopback) Status
Yes / Active
Firewall Filter Forward Status
Yes / Active
Port Forwarding Rule (DST-NAT)
add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)"
Hairpin NAT Rule (SRC-NAT Masquerade)
add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)"
Firewall Filter Accept Rule
add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"
Terminal Configuration Script (CLI)
# ===================================================================== # InfraCalc.web.id - Port Forwarding (DST-NAT) + Hairpin NAT (NVR-CCTV-Server) # Target: 203.142.77.10:8000 -> 192.168.88.250:8000 [TCP] # ===================================================================== /ip firewall nat # 1. DST-NAT: Arahkan trafik dari IP Publik / WAN ke IP Server Lokal add action=dst-nat chain=dstnat dst-address=203.142.77.10 dst-port=8000 protocol=tcp to-addresses=192.168.88.250 to-ports=8000 comment="Port Forward NVR-CCTV-Server (TCP 8000 -> 192.168.88.250:8000)" # 2. HAIRPIN NAT: Agar saat staf di jaringan lokal (192.168.88.0/24) mengakses IP Publik/Domain, tidak mental/timeout add action=masquerade chain=srcnat dst-address=192.168.88.250 dst-port=8000 out-interface-list=all protocol=tcp src-address=192.168.88.0/24 comment="Hairpin NAT Loopback NVR-CCTV-Server (TCP)" # 3. FIREWALL FILTER: Izinkan trafik forward hasil DST-NAT melewati firewall /ip firewall filter add action=accept chain=forward connection-nat-state=dstnat dst-address=192.168.88.250 dst-port=8000 protocol=tcp comment="Allow Forwarded Port NVR-CCTV-Server (TCP)"

Core Concept & Engineering Notes

Destination NAT (DST-NAT), commonly known as Port Forwarding, directs unsolicited incoming traffic from an external public IP address or WAN interface to a specific private IPv4 host located inside a local area network, such as a web server, internal database, Remote Desktop (RDP) workstation, or Network Video Recorder (NVR). Because RFC 1918 private address ranges cannot be routed across the public internet, the edge router must rewrite incoming packet headers to reach the intended local service. The most frequent operational dilemma encountered with port forwarding is local loopback failure, resolved by Hairpin NAT (also called NAT Reflection or NAT Loopback). When an internal employee inside the office attempts to access an in-house server using its external domain name or public IP, the client transmits packets toward the router's WAN address. The router performs destination NAT and forwards the packets to the internal server. However, because the server observes that the source IP belongs to its own local LAN subnet, it sends reply packets directly back to the workstation through the Layer 2 switch, bypassing the router entirely. The client rejects these incoming packets because it expects an acknowledgment from the public IP address, causing the connection to immediately time out. Hairpin NAT resolves this asymmetric routing breakdown by applying a localized Source NAT (masquerade) rule to inbound LAN-originated traffic directed at the server's private address. By rewriting the client's source IP to the router's local gateway address, the server is forced to route reply packets back through the router. The router translates the source IP back to the expected public address before returning it to the client, guaranteeing seamless access from both the internet and the local office network.

How It Was Calculated (Formulas & Steps)

Frequently Asked Questions (FAQ)

Why is my CCTV or internal server accessible from the internet but times out when connected to office Wi-Fi?

This is the classic symptom of missing Hairpin NAT. Internal clients reach out to the router's public IP; the local server replies directly over the local switch, which the client drops because the replying source IP does not match the public IP it contacted.

Do I need to specify a static Public IP if my router uses dynamic PPPoE or DHCP client?

If your public IP is dynamic, you can substitute the `dst-address` match condition with `in-interface=ether1-ISP` or `in-interface=pppoe-out1` in your RouterOS DST-NAT configuration rule.

Can the external public port differ from the internal server port?

Yes. Port translation allows you to expose public port 8080 on the WAN while mapping it to standard port 80 on your internal local web server.

Is port forwarding secure against internet attacks?

Any forwarded port is visible to public internet automated scanners. We strongly recommend changing well-known default ports (e.g. moving RDP 3389 to a high random port), using strong credentials, or accessing sensitive servers through a WireGuard VPN instead.

Related Calculators

View All Network & Routing Tools →
MikroTik Multi-WAN PCC Load Balance Calculator

Multi-WAN (2–5 ISP) proportional PCC load balancing and recursive failover configuration script generator for RouterOS v7.

MikroTik Bandwidth Calculator (Simple Queue, Burst, PCQ, FQ-CoDel)

Calculate Limit-At (CIR), Max-Limit (MIR), Burst, PCQ, and FQ-CoDel for RouterOS v7 with automated configuration script generation.

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

IPv4 Subnet Split and VLSM Planner

Split an IPv4 network into N equal subnets or allocate boundary-aligned VLSM blocks by required host count with CSV and Markdown export.

IPv6 Subnet Calculator and Prefix Planner (/48, /56, /64)

Expand and compress IPv6 addresses per RFC 5952, calculate network prefix boundaries, /64 SLAAC subnet counts, and child prefix blocks.

MikroTik QoS Priority and Anti-Lag Calculator

Prioritize WhatsApp calls, Zoom/Teams conferences, and gaming latency above bulk downloads using RouterOS v7 FQ-CoDel Queue Trees.

Complete Network & Routing Directory →

References & Notes

Last updated: Technically Verified · Industry Standard

Note: Results above are mathematical estimates based on standard formulas. Always verify against official vendor documentation and site conditions before production deployment.

🔗Related Scenarios & Companion Calculators

Browse All 30+ Scenarios →

⚡ Ready-to-Use Scenario Presets:

/32 = Mask 255.255.255.255 • 1 Usable Hosts→
/32 Subnet Mask (255.255.255.255): Usable Hosts (1), Wildcard & IPv4 Range

Instant /32 CIDR reference: Subnet Mask is 255.255.255.255, Wildcard 0.0.0.0, Total IPs 1, and 1 Usable Hosts. Ideal for OSPF/BGP Router Loopback & Single Host Route.

/30 = Mask 255.255.255.252 • 2 Usable Hosts→
/30 Subnet Mask (255.255.255.252): Usable Hosts (2), Wildcard & IPv4 Range

Instant /30 CIDR reference: Subnet Mask is 255.255.255.252, Wildcard 0.0.0.3, Total IPs 4, and 2 Usable Hosts. Ideal for Point-to-Point Inter-Router WAN Link (2 Usable IPs).

/29 = Mask 255.255.255.248 • 6 Usable Hosts→
/29 Subnet Mask (255.255.255.248): Usable Hosts (6), Wildcard & IPv4 Range

Instant /29 CIDR reference: Subnet Mask is 255.255.255.248, Wildcard 0.0.0.7, Total IPs 8, and 6 Usable Hosts. Ideal for DMZ Public Server Sub-Block & BGP Peering (6 Hosts).

🛠️ Sibling Calculators in this Category:

IPv4 Subnet and CIDR Calculator

Calculate IPv4 network address, broadcast, usable host range, netmask, wildcard, binary mask, and RFC address type (RFC 1918, /31, CGNAT).

IPv4 Subnet Split and VLSM Planner

Split an IPv4 network into N equal subnets or allocate boundary-aligned VLSM blocks by required host count with CSV and Markdown export.

IPv6 Subnet Calculator and Prefix Planner (/48, /56, /64)

Expand and compress IPv6 addresses per RFC 5952, calculate network prefix boundaries, /64 SLAAC subnet counts, and child prefix blocks.

MikroTik Bandwidth Calculator (Simple Queue, Burst, PCQ, FQ-CoDel)

Calculate Limit-At (CIR), Max-Limit (MIR), Burst, PCQ, and FQ-CoDel for RouterOS v7 with automated configuration script generation.

🔬 Scientific Methodology & Normative Verification

Engineering Sensitivity Analysis, Response Curve & Technical Citation

✓ Calibrated to ISO/IEC/IEEE/TIA Clauses

1. 1. 3-Point Engineering Sensitivity & Tolerance Envelope

Comparative evaluation across theoretical laboratory bounds (0% loss), current nominal operating point, and conservative field safety bounds (±15% thermal/aging derating).

Evaluated Parameter Ideal Theoretical Bound Nominal Operating Point Conservative Safety Bound (±15%) Engineering Derating Rule
External Port (Public) 7,200 8,000 9,200 Engineering Safety Margin (+15% Overhead)
Internal Port (Local) 7,200 8,000 9,200 Engineering Safety Margin (+15% Overhead)

2. 2. Mathematical Function Curve & Operating Coordinate (x₀, y₀)

MATHEMATICAL RESPONSE CURVE: OUTPUT METRIC VS INPUT PARAM Conservative Engineering Bound (+15% Safety Margin) 4 6 8 10 12 14 16 (x₀=10, y₀=100) Variabel Independen (x): Input Param

3. 3. Physical Constants & Normative Standard Clauses

R_loop(Cat6, 20°C) = 14 Ω/100m ANSI/TIA-568.2-D & IEEE 802.3bt

DC Loop Resistance for 23 AWG Solid Copper Cat6

Clause 6.4.1 / Table 145-1 — Nominal 23 AWG solid copper loop resistance at 20°C is 14.0 Ω/100m (TIA maximum ceiling is 18.8 Ω/100m).

α_opt(1490nm) = 0.25 dB/km ITU-T Rec. G.652.D & G.984.2

Single-Mode Optical Fiber Attenuation Coefficient at 1490 nm

Table 1 / Class B+ & C+ Optical Path — Typical G.652.D attenuation at 1490 nm downstream is 0.22–0.25 dB/km (1310 nm upstream: 0.35 dB/km).

α_Cu(20°C) = 0.00393 °C⁻¹ IEC 60028

Temperature Coefficient of Resistance for Copper

International Annealed Copper Standard — Used in thermal derating equation: R(T) = R_20 × [1 + 0.00393 × (T - 20)].

4. 4. Independent Technical & Academic Citation (IEEE / APA 7th / BibTeX / LaTeX)

Use the standard citation formats below to reference this computational methodology in engineering specifications, audit reports, or academic papers.

Format IEEE & APA 7th Edition

[IEEE] KalkuNet Engineering Team, "MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator — Standard Engineering Computational Instrument," KalkuNet Technical Suite, 2026. [Online]. Available: https://kalkunet.com/en/tools/mikrotik-nat-calculator. [Accessed: 2026-11-08].

[APA 7th] KalkuNet Engineering Team. (2026). MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator (Production release 2026-11-08) [Engineering computational software]. KalkuNet. https://kalkunet.com/en/tools/mikrotik-nat-calculator

BibTeX & LaTeX Derivation Snippet
@software{kalkunet_mikrotik_nat_calculator_2026,
  author = {{KalkuNet Engineering Team}},
  title = {{MikroTik Port Forwarding (DST-NAT) and Hairpin NAT Generator --- KalkuNet Engineering Suite}},
  year = {2026},
  publisher = {KalkuNet.com},
  url = {https://kalkunet.com/en/tools/mikrotik-nat-calculator},
  urldate = {2026-11-08}
}

% LaTeX Engineering Derivation — Generated via https://kalkunet.com/en/tools/mikrotik-nat-calculator
\begin{equation}
  \text{Model: } DST-NAT: chain=dstnat dst-address=Public_IP dst-port=External_Port action=dst-nat to-addresses=Internal_IP to-ports=Internal_Port
\end{equation}
% Parameter Input Terukur: desc = NVR-CCTV-Server, \; pubIp = 203.142.77.10, \; extPort = 8000, \; intIp = 192.168.88.250
% Hasil Evaluasi Numerik : wanIface = \mathbf{ether1-ISP}, \; pubIp = \mathbf{203.142.77.10}, \; extPort = \mathbf{8000}