Questions[routeros](server)

I'd like to set up port forwarding of tcp port 8000 -> 192.168.1.16:4200 on my Mikrotik RouterOS.

I've done the following:

/ip firewall nat add dstnat chain=dstnat action=dst-nat to-addresses=192.168.1.16 to-ports=4200 protocol=tcp dst-address=<PUBLIC_IP> dst-port=8000

When I try to use the service from the Internet then the following command just hangs:

curl <PUBLIC_IP>:8000

I can see the counters moving on the Mikrotik's NAT rule (via WebBox).

On the target machine, I can see the following in netstat -an | grep 4200:

tcp        0      0 0.0.0.0:4200            0.0.0.0:*               LISTEN
tcp        0      0 192.168.1.16:4200       <REMOTE_HOST>:37720     SYN_RECV

I verified that I am able to connect to the machine locally via curl 192.168.1.16:4200.

I can't figure out what can be wrong :(

UPDATE: Firewall filter rules:

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="fasttrack - except for ipsec" connection-mark=!ipsec connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

I'm configuring a wireless router. I know the non-ovelapping channels are 1,6 & 11. However, my router only specifies frequencies that I can select, not channels. What are the frequencies that map to channels 1,6 & 11?

Is it possible to set mikrotik authetication to be used for set the connection of other applications to internet using mikrotik proxy?

For example connect miranda IM using mikrotik proxy server:

I've tried to use hotspot login, bypass hotspot for selected MAC/IP (IP Bindings rule and and login without credentials), but it doesn't work..

I have an interesting problem. An ISP of ours started providing native IPv6 on their network. They provided us with a /56 prefix and a /126 linking segment (::1 being their endpoint and ::2 being ours). However, the ISP's DSLAM does not support Neighbor Discovery, so they asked us to provide our router's MAC address to manually enter in their neighbor table and provided us with theirs.

We are using Mikrotik's RouterOS 5.2 on our router and we have not been able to figure out how this can be done. For IPv4, it is simple, we can create a mapping under /ip arp, but for IPv6 the neighbor list (/ip neighbor) seems to be read-only.

We tried to work this around, by setting a fe80:: link-local address with the ISP's router's MAC address encoded in the EUI-64, but when we sent packets to that destination, RouterOS tried to resolve the address using ND nevertheless.

I am asking if there is a way to either create a static mapping IPv6 address -> MAC address or to create a route directly to a MAC address and the interface, so we can stop using tunnels for our IPv6 needs.

The RouterOS docs show how to transparently proxy all web traffic via the HTTP proxy built into RouterOS:

/ip firewall nat 
add in-interface=ether1 dst-port=80 protocol=tcp action=redirect to-ports=8080 chain=dstnat 
/ip proxy
set enabled=yes port=8080

I'd like to run a proxy on another machine, so that I can take advantage of more sophisticated filtering rules available in Squid or the like. However, if I use NAT to redirect traffic to another machine running Squid it won't work, since the HTTP request will need to be rewritten in order to be a proxy HTTP request; just redirecting the traffic gives bad request errors from Squid.