Can't get port forwarding working

RouterOS Beginner Basics
1

Hello, new guy here.

So i got mikrotik hex rb750gr3.
I started from default out of box configuration.
And now i’m learning my way around RouterOS, cause i was used to noob-friendly UI from simple home routers, and i can’t get port forward to work.
For example i’m simply trying to port forward minecraft server on 25565 port, ether1 is where ISP cable is plugged. ether1 interface is set to WAN and bridge is LAN.

ip firewall export compact:

# aug/03/2020 01:05:52 by RouterOS 6.44.6
# software id = B19J-K8YI
#
# model = RB750Gr3
# serial number = CC210B1EE3A8
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Minecraft server" dst-port=25565 in-interface=ether1 protocol=tcp to-addresses=192.168.88.254 to-ports=25565

What am i doing wrong?

2

Bump.

EDIT: If i change in interface for dst-nat rule then atleast i can see firewall capturing packets, but i can’t still get connection.

3

If you don’t see packet counters increasing for dst-nat rule when testing from outside - packets never reach the router at all.
Are you sure that you router is actually getting a public IP?

By “changing in-interface” you mean not only changing it in the rule, but also trying to test from inside your LAN?
If so, it is expected that it doesn’t work - your need additional src-nat rule (so called “hairpin nat”) to make it work from the same LAN segment.

4
  1. Is you WANIP dynamic or a fixed static wanip?
  2. Are you trying to reach your server from the same LAN as the server (but using the wanip instead of the easier LANIP of the server itself)?