How to Set Up Port Forwarding on a MikroTik hAP ax²

Port forwarding lets you make a device or service on your home or office network accessible from the internet. Common examples include a web interface for a router, a CCTV recorder, a NAS, or a game server.

This guide walks you through setting up port forwarding on a MikroTik hAP ax² Dual Band Router (C52iG-5HaxD2HaxD-TC). The steps are very similar on most MikroTik routers.

Before You Start

Security note: Port forwarding opens a service on your internal network to the wider internet. Whenever possible, we recommend using a VPN instead (for example an L2TP/IPsec VPN click the link for a guide) so you can connect securely and keep services closed to the public internet.

CGNAT limitation: Port forwarding and VPNs will not work if your internet connection uses carrier-grade NAT (CGNAT). If your WAN IP address is in the range 100.64.0.1–100.127.255.254, your ISP is using CGNAT. In that case you will need to speak to your provider about a public IP address.

You will also need to be able to log in to your MikroTik using WinBox or the web interface (WebFig). See our basic setup guide here.

Example Set-Up Used in This Guide

To keep things clear, we will use the following example values:

• Router LAN IP: 192.168.88.1
• Internal device IP: 192.168.88.5
• Service on the device: Web interface (HTTP on port 80)
• External port on the router: 8000

You can adjust the IP addresses and ports to match your network. The process is the same.

Step 1 – Open the Firewall Settings

1. Log in to your MikroTik router.
2. Go to IP → Firewall.
3. Select the NAT tab.

Step 2 – Create a New NAT Rule

1. On the NAT tab, click + to add a new rule.
2. On the General tab, set:
   • Chain: dstnat
   • Protocol: 6 (tcp)
   • Dst. Port: the external port you want to open on the router (for example 8000).
   • In. Interface List: select your WAN or internet-facing interface list (often called WAN).

It is usually better to choose a less obvious external port such as 8000 or 8443, rather than the default service port, to reduce the amount of unwanted scanning traffic.

Step 3 – Configure the NAT Action

1. In the same NAT rule window, switch to the Action tab.
2. Set:
   • Action: dst-nat
   • To Addresses: the internal device IP, for example 192.168.88.5
   • To Ports: the internal service port, for example 80 for HTTP or 443 for HTTPS
3. Click Apply or OK to save the rule.

Your MikroTik will now take any traffic that arrives on port 8000 on the WAN and forward it to port 80 on 192.168.88.5 inside your network.

Step 4 – Set Up MikroTik Cloud DDNS (Optional but Recommended)

If you have a static public IP address from your ISP, you can reach your router using that IP. If your public IP changes from time to time (which is common on standard broadband), it is much easier to use MikroTik’s free Cloud DDNS service.

1. Go to IP → Cloud.
2. Tick DDNS Enabled.
3. Note down the DNS Name shown. It will look something like: hjs0aj9th33.sn.mynetname.net.
4. Click Apply or OK.

This DDNS name will always point to your router’s current public IP address, so you do not need to keep checking and updating IP details manually.

Step 5 – Test Remote Access

To access your forwarded device from the internet, use your DDNS name (or public IP) followed by the external port you chose.

Using the example in this guide, that would be:

hjs0aj9th33.sn.mynetname.net:8000

Important: Make sure you test from outside your own network. For example, turn off Wi-Fi on your mobile and use mobile data, or test from a different location. If you test from inside the same LAN, the result may not reflect how it behaves from the wider internet.

Troubleshooting and Testing Tips

• Ping test: Try pinging your DDNS name or public IP. If ping does not work but you expect it to, you may need to allow ICMP in your firewall rules.
• Check open ports: Use an online port checker to confirm the external port you chose (for example 8000) is open from the internet.
• Test externally: Always repeat tests while not connected to the MikroTik’s LAN, otherwise you might be seeing internal traffic rather than true external access.

You have now configured your MikroTik router to forward traffic from the internet to a specific device on your internal network. This is useful when you need to reach a web interface, CCTV recorder, or other service remotely.

If you need additional services, repeat the same process with new external ports and internal IP addresses as required. If security is a concern, consider using a VPN instead of opening ports directly to the internet.

Need MikroTik hardware or help?

Browse MikroTik devices  •  Contact our team