Configure Hairpin NAT on RouterOS (Mikrotik)

In this article I will give an example of setting Hairpin NAT on RouterOS (Mikrotik).

I happen to have a server or a DVR in the local network, the ports to which are forwarded in the firewall, but you can connect only from other networks, and from the local network it is obtained only by the local IP address, but not external, on the WAN interface of the router.

Suppose the router’s WAN IP address is, the LAN is, the server’s IP address is

Suppose there is a standard NAT rule (let’s leave it):

ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=ether1

Now configure “Hairpin NAT” (forward port 22 for SSH):

ip firewall nat add action=dst-nat chain=dstnat dst-address= dst-port=22 protocol=tcp to-addresses=
ip firewall nat add action=masquerade chain=srcnat dst-address= dst-port=22 out-interface=bridge protocol=tcp src-address=


See also my article:
Port forwarding on Mikrotik routers
Configuring Remote Access in Mikrotik Router

Join the Conversation


Leave a Reply

  1. This is the most simple and comprehensive example for Hairpin configuration that I found on the internet and it works smoothly. Thank you so much for sharing.

  2. Doesn’t that mean that the clients’ IP addresses will be always NATted to the router’s LAN address, even if the request comes from source (example) to destination I know this is the official Mikrotik solution, but is it elegant enough?