THe issue is not clear to me as I would not configure it the way you have but it may be hidden in the firewall rules…
They are kinda like the default but not quite and the additions/modification suck (sorry tdw )
Suggest from this…
/ip firewall filter
add action=accept chain=input comment="Accept all connections establish, related, and untracked" connection-state=established,related,untracked connection-type="" log=yes log-prefix=INPUT-EST_RELATED_UNTRACKED
add action=accept chain=input comment="PING OUTSIDE -> IN" log=yes log-prefix=ICMP_FROM_OUT protocol=icmp
add action=drop chain=input comment="DROP INVALID CONNECTION" connection-state=invalid log=yes log-prefix=DROP_INVALID
add action=drop chain=input comment="Drop all packets from outside" in-interface=ether1 log=yes log-prefix=DROP-ALL
add action=accept chain=forward comment="ACCEPT ESTABLISHED, RELATED, UNTRACKED - FORWARD" connection-state=established,related,untracked
add action=drop chain=forward comment="DROP INVALID - FORWARD" connection-state=invalid log=yes log-prefix=INVALID_FORWARD
add action=accept chain=forward comment="ALLOW FORWARD OUT TO WEB" out-interface=ether1
add action=accept chain=forward comment="ALLOW FROM LAN_VLAN TO DMZ_VLAN"dst-address-list=DMZ_ADDRESS_VLAN src-address-list=LAN_ADDRESS_VLAN
add action=drop chain=forward comment="LAST RULE - DROP ALL ELSE FORWARD"
…
To this
Forward Chain.
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
disabled=yes in-interface-list=!LAN
Forward chain…
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=accept in-interface-list=LAN out-interface=WAN comment=“Allow LAN to WAN traffic”
add action=accept in-interface=vlan10 out-interface=vlan100 comment=“Allow LAN users to access DMZ”
***add action=accept chain=forward comment=“allow port forwarding”
connection-nat-state=dstnat connection-state=new in-interface=WAN
add action=drop chain=forward comment=“Drop all else”
…
*** Looks like you were missing the firewall rule for port forwarding.
PS… ensure you do have something like this in the config!!
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
and
/interface list member
add comment=defconf interface=eth1 list=WAN
add interface=vlan10 list=LAN
add interface=vlan100 list=LAN
I think the show stopper is that firewall filter does not include rule which actually allows DST-NATed connections. Constructing DST-NAT rules is not enough in Mikrotik world (mind that this has its merits). Default configuration has a rule (the last in list) which combines allowing dst-nat-ed connections and dropping the rest. In your context, you need a rule like this:
and move it to penultimate place (above the “drop everything else from outside” rule).
Another thing which strikes me odd (but might be just fine) is that you have VLAN 100 tagged over ether3 … which means some other device (either a switch or the server itself) has to deal with tagged frames. If router can ping server @192.168.100.10 (and vice versa), then this is fine though.
)