A self-signed certificate across the house: a MikroTik NAT rule with no inbound interface
From home, sites like Spotify showed a self-signed certificate error and Firefox wouldn't even allow an exception. From outside they were fine. The culprit was an overly broad NAT rule on the router.
- MikroTik
- Traefik
Symptom
Any HSTS site failed from the home network with MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT. With HSTS the browser doesn't offer «continue anyway», so you simply couldn't get in.
On mobile data, the same sites worked perfectly.
Cause
On the MikroTik there's a dstnat rule forwarding port 443 to the reverse proxy (Traefik) to publish the home websites. It was defined with dst-address-type=local and nothing else.
Without the condition that traffic comes in on the WAN, the rule also caught connections from inside the house that went through the router's IP. Traefik answered with its internal certificate, and the browser saw it as self-signed.
How to spot it
- /ip firewall nat print → look for a dstnat rule on 443 with no in-interface-list.
- curl -v https://<an HSTS site> from inside → the certificate isn't that site's, but the proxy's.
Fix
Scope the rule to traffic coming in on the WAN and flush open connections so they're rebuilt with the new rule:
/ip firewall nat set [find comment="HTTPS"] in-interface-list=WAN
/ip firewall connection remove [find]