Allow API access from outside the LAN

I’d like to allow API access outside my local network. So far, I’ve been unable to get this to work.

What I’ve tried so far:

Turn on the API service and allow from 0.0.0.0/0
Forward the API port to the router
Add in a firewall rule like http://networkingforintegrators.com/2012/08/accessing-a-mikrotik-router-through-winbox-over-the-internet/ only with the API port (above the final DROP rule)

I have a feeling that something else I’ve done is prohibiting this access before I get to the API. I have not tried accessing it from inside the LAN yet, but will as soon as possible. Anything I should be looking at here?

it should not be different prom accessing router with CLI or winbox. check firewall.

Thanks. I took a look at the firewall again, and noticed there are two drop rules. I moved the API access rule up, and it works now.