In the end I used srcnat to router’s external IP so basically hairpin NAT just with public IP, not private. It works. Servers see in logs my external public IP and packets are “properly” forwarded. Except 2 issues:
- I don’t have static IP but I made script that updates this rule alongside with sending update to dyndns via API.
- http://forum.mikrotik.com/t/hairpin-nat-bypasses-firewall-potential-security-issue/122381/1