Forward SSH login to Internal IP address

A client of ours has a Linux server sitting on 192.168.0.1 behind a newly installed RB3011.

They require remote access via ssh to their linux server using a DynDNS address, redirecting to the WAN IP. When adding nat rules below to target internal Linux server, ssh attempts are reaching the Mikrotik SSH login and not the server IP…

These are the rules that I have added

/ip firewall nat
add chain=dstnat action=dst-nat in-interface=ether1 protocol=tcp dst-port=8080 to-addresses=192.168.0.1 to-ports=22
/ip firewall filter
add chain=forward in-interface=ether1 protocol=tcp dst-address=192.168.0.1 dst-port=22


These are the requirements for client - Kindly assist

Port 22 → 192.168.0.1
Port (range) 16001 - 16190 → 192.168.0.1
Port 8080 → 192.168.0.12


Port 22 is for SSH access to the main (Master) Linux server and the Port range is for all our remote support devices to connect to the main (Master) Linux server database.
Port 8080 is required to connect to the QNAP backup device that sits inside network on the IP address 192.168.0.12.

Help would be appreciated, thank you

Rules are incorrect, you need only NAT rules, because they works before routing decision.

/ip firewall nat
add chain=dstnat action=dst-nat in-interface=ether1 protocol=tcp dst-port=22 to-addresses=192.168.0.1 to-ports=22
/ip firewall nat
add chain=dstnat action=dst-nat in-interface=ether1 protocol=tcp dst-port=8080 to-addresses=192.168.0.12 to-ports=8080