Hi all.
Let me show a diagram although I think problem is simple to understand 
However since I’m not able to solve it I’m asking for help.
So I have a public domain which I use to access a server in my local network.
I redirect domain to my public ip where mikrotik is listening on port 443 (allowed on firewall).
By default this would open Mikrotik web interface, however, I setup a NAT forward to redirect this to actual server that I want to connect to by redirecting my ether1 (interface connected to my ISP router or using ‘WAN’ interface list) 443 access to target server ip and port.
This worked perfectly, both from internal and external network when using a public domain. That was setup used with ISP router mode.
Yesterday I switched to bridge mode and while everything else works with same setup, this part doesn’t.
My external access still works using a public web domain, but from internal network I cannot access it anymore (as I don’t have https service enabled - if I enable it, with certificate, I end up on mikrotik web interface).
Pinging this domain I get back public ip when on internal network.
I guess before this was handled somehow by my ISP router so I have to configure it on Mikrotik but I’m not really sure what I’m targeting.
If my laptop would still be going through public network when connected to local network then I would expect for existing NAT rule to work.
If it goes directly to local Mikrotik IP (which I guess is what really happens looking at traceroute) then I have other challenges as I’m trying to reuse 443 port for when I’m going over a public domain, but have it working as expected for Mikrotik web inteface when going over local ip / hostname, in that case using another port might be simpler but I guess there is a solution to have it as it was before
My config
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment=https dst-port=443 protocol=tcp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.88.21 to-ports=8123
Thanks in advance