Hello, Please, I am still a layman in understanding the logs. This is still spamming our router, what does it mean? Could someone explain this to me in detail please? Thank you. 
dstnat: in:ether1-WAN1 out:(unknown 0), src-mac f4:a4:d6:dd:2b:6a, proto TCP (SYN), 185.23.114.194:51504->46.243.71.151:993, len 64
Remote device with IP address 185.23.114.194 is trying to connect (your router’s ?) IP address 46.243.71.151 TCP port 993 (POP3S / IMAPS) … but from the log is not clear if connection succeeds … really depends on overall firewall setup (not just DST NAT part).
Thank you for the quick and concise reply.
The IP address of the router is: ether1: 46.243.71.151
Because we have a mail server in the network, port 993 is open. It is only open from IP addresses: Slovakia address list and Italy address lsit. Other countries are blocked.
How can you ensure even more DST-NAT?
Or are we making a mistake somewhere?
If you want to get some more (meaningful) feedback, you’ll have to post full firewall config.
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=
established,related
add action=accept chain=input comment=“accept established,related”
connection-state=established,related
add action=drop chain=input comment=“drop invalid” connection-state=
invalid,untracked
add action=drop chain=input comment=“PING na wan” protocol=icmp
src-address-list=!CountryIPBlocks
add action=accept chain=input comment=“accept ICMP” protocol=icmp
add action=drop chain=input comment=“drop coming from WAN” in-interface-list=
WAN src-address-list=!CountryIPBlocks
add action=accept chain=input comment=“accept PPTP,SSTP” dst-port=1723,443
protocol=tcp
add action=accept chain=input comment=“accept L2TP” port=1701,500,4500
protocol=udp
add action=accept chain=input comment=“accept L2TP” in-interface=ether1-WAN1
protocol=ipsec-esp
add action=accept chain=input comment=“Accept WINBOX and WWW from WAN”
dst-port=8291,8292,3635 protocol=tcp src-address-list=CountryIPBlocks
add action=drop chain=input comment=“drop all not coming from LAN”
in-interface-list=!LAN
add action=drop chain=forward comment=“Access from VPN to one IP”
dst-address=!10.0.0.199 src-address=192.168.89.151
add action=drop chain=forward comment=“Drop Invalid” connection-state=invalid
You didn’t show NAT rules.
Other than that, your firewall filter rules are pretty permissive, it’s basically allowing most of traffic to pass between all directions (WAN to LAN, LAN to WAN, …)
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=MASQ src-address-list=
MASQ-IP
add action=dst-nat chain=dstnat comment=Mail_993 dst-address=
46.243.71.151 dst-port=993 log=yes protocol=tcp src-address-list=
CountryIPBlocks to-addresses=10.0.0.6 to-ports=993
add action=src-nat chain=srcnat comment=
“Mail_993_HARPIN NAT” dst-address=10.0.0.6
dst-port=993 protocol=tcp src-address-list=MASQ-IP to-addresses=
10.0.0.138
add action=dst-nat chain=dstnat comment=Mail_465_ dst-address=
46.243.71.151 dst-port=465 log=yes protocol=tcp src-address-list=
CountryIPBlocks to-addresses=10.0.0.6 to-ports=465
add action=src-nat chain=srcnat comment=“Mail_465 HARPIN NAT”
dst-address=10.0.0.6 dst-port=465 protocol=tcp src-address-list=MASQ-IP
to-addresses=10.0.0.138
add action=dst-nat chain=dstnat comment=Mail_995 dst-address=
46.243.71.151 dst-port=8995 log=yes protocol=tcp src-address-list=
CountryIPBlocks to-addresses=10.0.0.6 to-ports=995
add action=src-nat chain=srcnat comment=“Mail_995_ HARPIN NAT”
dst-address=10.0.0.6 dst-port=995 protocol=tcp src-address-list=MASQ-IP
to-addresses=10.0.0.138
add action=dst-nat chain=dstnat comment=
“VNC na 78” disabled=
yes dst-address=46.243.71.151 dst-port=55901 log=yes protocol=tcp
src-address-list=CountryIPBlocks to-addresses=10.0.0.78 to-ports=5900
add action=dst-nat chain=dstnat comment=Gui_10.0.0.94 dst-address=
46.243.71.151 dst-port=5999 protocol=tcp src-address=95.237.87.0/24
to-addresses=10.0.0.94 to-ports=5900
MASQ-IP (list local network IP)
MASQ (list interface - ethernet 1 - WAN)
10.0.0.138 - GW (router)
I think I can see that logging is enabled there.
It’s probably the spam
Yup, your DST NAT rules have logging enabled.
Whether logs are then spam or not is up to you to decide. But probably they are as they simply log the fact some remote client tried to established a connection to forwarded port. It doesn’t tell anything about whether client actually succeeded in establishing connection (and is thus most probably a legitimate client) or not (and is thus probably a port scanner).
I just want to add that restricting remote IP addresses to country IP block doesn’t exactly prevent the service from being attacked, one should assume that attacks can originate from anywhere in the world. But restricting does make source pool for attacks smaller, so it makes problem slightly smaller.
Great, thanks for the help and for clarifying this issue.