Cloud detects WAN IP, but says it is behind NAT

I have two networks connected to Mikrotik. Each has IP address set to Bridge. Under IP/Cloud under Public Address I can see the public IP so from Bridge that has 0.0.0.0/24 route which is correct. But I still get a message “Router is behind a NAT. Remote connection might not work”. Also if I enable BTH it will go over relay and not dirrectly.

How to debug this? What could case it beeing detect as router behind NAT?

On your router, look in “IP address” and check which IP address is listed for your WAN interface. Then compare it to pubic IP address, reported in various places (cloud is one thing, there are several web pages telling you this information). If they are not the same, then your WAN IP address is still behind NAT.

Also, if your WAN IP address falls into one of the private network address ranges (including carrier-grade NAT), then you’re definitely behind NAT.

On my Bridge-WAN interface, the public IP is set as static, not over DHCP. And it starts with 84.X.X.X/18. Looking at Cloud Pubic Address I see same IP 84.X.X.X. So public IP on Bridge-WAN interface and detected in Cloud under Public Address is the same. And this IP is for sure not in any private network address range.

But I still see “Router in behind a NAT. Remote connection might not work”. Could it be that a firewall rule prevents proper detection?