Hairpin NAT from LAN to DMZ

RouterOS General
1

Hi.
I’m trying to make working Hairpin NAT from LAN to DMZ
I read an article http://wiki.mikrotik.com/wiki/Hairpin_NAT , but have no luck.
I tried scheme ( LAN in the same NET with DMZ ) like in article and it works.

MY SCHEME
https://postimg.org/image/5nc3v7sxj/

My rules

add action=dst-nat chain=dstnat comment="Hairpin NAT DMZ WAN" dst-address=22.22.22.22 dst-port=443 protocol=tcp to-addresses=192.168.1.2 to-ports=443
add action=masquerade chain=srcnat dst-address=192.168.1.2 dst-port=443 out-interface=BR_DMZ protocol=tcp src-address=10.100.1.2

not working

LOG tell that rules is working (but web cert not loading, while add it to exeptions), it tell waiting to loading page

firewall,info dstnat: in:LAN out:(none), src-mac d0:17:c2:93:fe:f8, proto TCP (SYN), 10.100.1.2:55651->22.22.22.22:443, len 52 
firewall,info srcnat: in:(none) out:BR_DMZ, src-mac d0:17:c2:93:fe:f8, proto TCP (SYN), 10.100.1.2:55651->192.168.1.2:443, NAT 10.100.1.2:55651->(22.22.22.22:443->192.168.1.2:443), len 52
2

If you have client and server in different subnets, you don’t need hairpin NAT, because the problem that it solves does not occur. That being said, it should work. Try to check forward chain. Since srcnat rule cought something, client->server traffic is allowed. So it leaves the other direction. But I’d assume that you probably have standard rule to allow established connections, so it should work too.