HAIRPIN NAT NOT WORK

RouterOS General
1

Config export, please.

2

My apologies, the export in your original message did not show when I read it first.

This one is almost correct - remove the to-addresses. You do not need to masquerade behind the public IP, just behind the local IP of the router.

/ip firewall nat
add action=masquerade chain=srcnat comment=TEST-HAIRPIN dst-address=\
172.16.0.0/24 src-address=172.16.0.0/24 to-addresses=103.xx.xx.xx

Second, depending on what the IP-PLUIT address-list contains, you may have to add a rule for accepting the local traffic, such as the following, and move it above your deny.

/ip firewall filter
add action=accept src-address=172.16.0.0/24 dst-address=172.16.0.0/24