Hi everyone!
I’ve set up Site-to-Site VPN using AWS official docs.
Everything is working fine.
But I have additional requirement, which I’m struggling with.
All connections coming from AWS private subnet (192.168.255.0/24) should be NATed and on the private network (192.168.0.0/24) side with source ip addr 192.168.0.123.
There is special hardware on the Server connection to which are allowed only from specific address.
Is it possible to configure Mikrotik in the such way?
Easy, you need only one srcnat rule:
/ip firewall nat
add chain=srcnat src-address=192.168.255.0/24 action=src-nat to-addresses=192.168.0.123
Thank you, Sob!
Yes, it’s working.
Turned out that my mistake was adding dst-address to nat rule
/ip firewall nat
add chain=srcnat src-address=192.168.255.0/24 dst-address=192.168.0.3/24 action=src-nat to-addresses=192.168.0.123
Actually no, if only this server needs is, it’s probably good idea. The only mistake is netmask, dst-address=192.168.0.3/24 is wrong, it should be only dst-address=192.168.0.3 (or dst-address=192.168.0.0/24 for whole network).
hmm, actually GUI even doesn’t let me to create this rule with dst-address=192.168.0.3/24
So seems like previously i did something wrong somewhere else 
Anyway, good that now it’s working like it should.
Thank you, Sob, for your help!