MikroTik: how to redirect traffic to (TL-MR3020 + 4G modem)?

Question

Huawei

Good afternoon!
There is a MikroTik router, a TL-MR3020 router with a 4G modem is connected to it via ether2.
On MikroTik, in the ether1 connector - the Internet is connected with a static ip: 109.167.131.88
How to make something like a proxy so that when you access 109.167.131.88:5100 - the traffic is redirected to the 4G modem and back? That is, when accessing a static ip with a port, access the Internet through a modem corresponding to the 4G port.
I would like to connect several of these proxies:
ether1 (109.167.131.88:5100) <-> ether2 (TL-MR3020 + 4G)
ether1 (109.167.131.88:5101) <-> ether3 (TL-MR3020 + 4G)
Thanks in advance!

Answer 1

It's not clear to you what you want to get :)
do you need to get on the web face of the modem or where?

Answer 2

What you describe is not feasible. Those. you somehow want to knock on port 5100 without configuring anything on the client? And that the traffic would walk along a different route. Impossible.
If you just need to forward traffic not through the default gateway when accessing 109.167.131.88:5100, for example, via RDP, then you can.
But to answer the question, you need to formulate it correctly.

Answer 3

On Mikrotik, you will not be able to perform this trick with a proxy, because. ROS can only launch one proxy server instance, which means there are no parameters by which to determine where to direct traffic after passing through the proxy. There is only an option to send forward traffic through one gateway, and output traffic (local, with a proxy) through another.

Answer 4

Respondents, did you read the question?
Regular PBR. On the tick in the mangle, you need to add a routing mark to traffic with dst-address 109.167.131.88 dst-port 5100.
That's it.

Answer 5

Additional data:
ether1 - static ip: 109.167.131.88 (to which we make a request from the Internet on port 51000)
ether4 = router to which we want to redirect traffic (dhcp ip: 192.168.1.110, gateway: 192.168.1.1)
There is even an incoming port 80 or 443 or any other, then there is no result.
Now it's set up like this:

/ip firewall nat
add action=dst-nat chain=dstnat comment=test dst-port=51000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.110 to-ports=443

/ip firewall Mangle
add chain=prerouting dst-address=109.167.131.88 protocol=tcp dst-port=51000 action=mark-routing new-routing-mark=ProxyMark

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=ether4 routing-mark= ProxyMark scope=30 target-scope=10

The log is like this:

19:03:17 firewall,info prerouting: in:ether1 out:(unknown 0), src-mac 00:1b:0d:ed:5b:c0, proto TCP (SYN), 188.170.74.70:35586->109.167.131.88:51000, NAT 188.170.74.70:35586->(109.167.131.88:51000->192.168.1.110:443), len 64
19:03:18 firewall,info prerouting: in:ether1 out:(unknown 0), src-mac 00:1b:0d:ed:5b:c0, proto TCP (SYN), 188.170.74.70:26060->109.167.131.88:51000, NAT 188.170.74.70:26060->(109.167.131.88:51000->192.168.1.110:443), len 64
19:03:18 firewall,info prerouting: in:ether1 out:(unknown 0), src-mac 00:1b:0d:ed:5b:c0, proto TCP (SYN), 188.170.74.70:31894->109.167.131.88:51000, NAT 188.170.74.70:31894->(109.167.131.88:51000->192.168.1.110:443), len 64
19:03:18 firewall,info prerouting: in:ether1 out:(unknown 0), src-mac 00:1b:0d:ed:5b:c0, proto TCP (SYN), 188.170.74.70:35586->109.167.131.88:51000, NAT 188.170.74.70:35586->(109.167.131.88:51000->192.168.1.110:443), len 6

If you try to do this:

/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-mark= ProxyMark scope=30 target-scope=10

That is, change ether4 to 192.168.1.1, then it writes: "192.168.1.1 unreachable"
Although this is the gateway of the router to which you need to send traffic ...
/ ip route - should it see gateway 192.168.1.1 at all?
If we change back to ether4, we get - "reachable".
In my opinion, no traffic goes to the router (192.168.1.110 ether4)
Already broke my head... Please help!)