I have a mikrotik RB2011 router/firewall. Inside the firewall I have a web server that has an private IP (lets say it's 192.168.1.5)
On the WAN side of the firewall I have a static IP (assume it's 22.214.171.124 - www.example.com).
The firewall/router is running NAT.
I have a dstnat rule to pass through HTTPS traffic to the server and that works.
Now the age old problem is that if an internal PC tries to connect https://www.example.com it fails to load the page with this error in chrome:
Google Chrome's connection attempt to www.example.com was rejected. The website may be down or your network may not be properly configured.
Here are some suggestions: Reload this web page later. Check your Internet connection. Reboot any routers, modems or other network devices that you may be using. Add Google Chrome as a permitted programme in your firewall or antivirus software's settings. If it is already a permitted programme, try deleting it from the list of permitted programmes and adding it again. If you use a proxy server, check your proxy settings or contact your network administrator to make sure the proxy server is working. If you don't believe you should be using a proxy server, adjust your proxy settings: Go to the Chrome menu > Settings > + Show advanced settings > Change proxy settings... and make sure your configuration is set to "no proxy" or "direct." Error 102 (net::ERR_CONNECTION_REFUSED): The server refused the connection.
Traditionally I have solved this by using a split DNS or dual DNS type of setup where dns lookups to www.example.com returned the internal IP of the server rather than the external. However I don't have the luxury of that setup here.
There should be a way to solve this on the mikrotik using a prerouting rule but I'm unsure how to set that up. How would I do that?
This is what I have in my nat table. But again, it doesn't. I am running tcpdump on the server but I can see that the and the packets are not actually reaching it.
[admin@MikroTik] /ip firewall nat> print Flags: X - disabled, I - invalid, D - dynamic 0 chain=dstnat action=dst-nat to-addresses=192.168.0.10 protocol=tcp dst-address=114.134.xxx.xxx in-interface=wan dst-port=22 1 chain=dstnat action=dst-nat to-addresses=192.168.0.10 protocol=tcp dst-address=114.134.xxx.xxx in-interface=wan dst-port=443 2 chain=srcnat action=masquerade src-address=192.168.0.0/24 dst-address=192.168.0.0/24 3 ;;; default configuration chain=srcnat action=masquerade to-addresses=114.134.xxx.xxx out-interface=wan