Open access from the internet to a CCTV, server or router inside the LAN, with optional hairpin NAT.

Each row forwards one public port to a device in the LAN. Hairpin NAT is needed when devices in the LAN also open that service through the public IP (not the local IP).

• These dstnat rules must be above other NAT rules that catch the same port.
• If the ISP gives you a private IP (CGNAT, e.g. 100.64.x.x), port forwarding from the internet cannot reach you; ask the ISP for a public IP or use a VPN/tunnel.

How to use: Copy the script, open Winbox → New Terminal, paste. Or Download .rsc, upload it in Files, then run /import file-name=port-forward.rsc.

RouterOS v6 / v7 · added 10 November 2026