hotspot and allowed ports

I have a customer who wishes to be able to access their personal Mikrotik that is behind our hotspot via port 8291 and it doesn’t appear to be working. They also wish to access port 4242 as that is what they have their SSH services set up as.

I’ve tried the following filter rules and they don’t appear to be working.

1 chain=forward action=accept protocol=tcp port=8291
2 chain=forward action=accept protocol=tcp port=4242


Any suggestions?

i think u should use input chain

input - used to process packets entering the router through one of the interfaces with the destination IP address which is one of the router’s addresses. Packets passing through the router are not processed against the rules of the input chain