Port forwarding (no tunnel)

For RouterOS 6, or a router without WireGuard. Your router forwards two ports on your public IP to the OLT, and only our server (the MyOLT server) is allowed through.

Tunnel or port forwarding?

	WireGuard tunnel (recommended)	Port forwarding
Router	RouterOS 7	Any router with port forwarding (RouterOS 6, others)
Public IP	Not needed — the router dials out	Static public IP needed
Open to the internet	Nothing	2 ports, allowed only from our server
Status, signal, authorize, TR-069	All	All — same speed
Two ISPs with the same LAN	No clash	No clash

MikroTik commands

Paste in Winbox → New Terminal. For a second OLT use ports 2324 / 2162, and so on.

/ip firewall address-list add list=MyOLT address=103.67.54.104 comment="MyOLT panel"
/ip firewall nat add chain=dstnat src-address-list=MyOLT protocol=tcp dst-port=2323 action=dst-nat to-addresses=192.168.88.10 to-ports=23 comment="MyOLT telnet"
/ip firewall nat add chain=dstnat src-address-list=MyOLT protocol=udp dst-port=2161 action=dst-nat to-addresses=192.168.88.10 to-ports=161 comment="MyOLT SNMP"
/ip firewall nat add chain=srcnat src-address-list=MyOLT dst-address=192.168.88.10 action=masquerade comment="MyOLT replies"
/ip firewall filter add chain=forward src-address-list=MyOLT dst-address=192.168.88.10 action=accept comment="MyOLT (move above drop rules)"

The masquerade rule makes the OLT see your MikroTik (192.168.88.1) instead of our server, so the OLT needs no route to the internet and its access list only needs your MikroTik.

Add the OLT in your panel

OLTs → Add: IP = your public IP 203.0.113.20, telnet port 2323, SNMP port 2161, model "Detect automatically", telnet user and password, SNMP empty → Save. Everything else is the same as with the tunnel.

The same commands, filled in for you, are also on your panel's Connect network page.

Other routers

Forward TCP 2323 → OLT port 23 and UDP 2161 → OLT port 161, and if the router can, allow them only from 103.67.54.104.