I have public ip and cant forward it to port 3 that the DVR is connected.
there are the setting:
/interface bridge
add admin-mac=B8:69:F4:AC:FB:EA auto-mac=no comment=defconf name=bridge
add name=bridge-DVR
add ingress-filtering=yes name=bridgeWAN pvid=20 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=ether2 ] name=ether2-Router
set [ find default-name=ether3 ] name=ether3-DVR
set [ find default-name=ether5 ] name=ether5-VOIP
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.50
add name=dhcp_pool1 ranges=192.168.1.2-192.168.1.254
add name=dhcp_pool4 ranges=192.168.1.2-192.168.1.254
add name=dhcp_pool5 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=default-dhcp bootp-support=dynamic disabled=no interface=
bridge name=defconf
add address-pool=dhcp_pool5 disabled=no interface=bridge-DVR name=dhcp1
/interface bridge nat
add action=accept chain=srcnat
/interface bridge port
add bridge=bridge comment=defconf interface=ether4
add bridge=bridgeWAN comment=defconf interface=ether5-VOIP pvid=30
add bridge=bridge interface=ether2-Router pvid=20
add bridge=bridgeWAN interface=ether1-WAN pvid=10
add bridge=bridge-DVR interface=ether3-DVR
/ip neighbor discovery-settings
set discover-interface-list=all
/interface bridge vlan
add bridge=bridgeWAN tagged=ether1-WAN vlan-ids=20
add bridge=bridgeWAN tagged=ether1-WAN untagged=ether5-VOIP vlan-ids=30
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=bridgeWAN list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=
192.168.88.0
add address=213.57.XX.XX/XX interface=bridgeWAN network=213.57.XX.XX
add address=192.168.1.1/24 interface=bridge-DVR network=192.168.1.0
/ip dhcp-client
add comment=defconf interface=bridgeWAN
/ip dhcp-server lease
add address=192.168.88.49 client-id=1:14:49:bc:2e:86:3a comment=
“Inside router” disabled=yes mac-address=14:49:BC:2E:86:3A server=
defconf
add address=192.168.88.49 client-id=1:14:49:bc:2e:86:3a mac-address=
14:49:BC:2E:86:3A server=defconf
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=8.8.8.8 gateway=192.168.1.1
add address=192.168.88.0/24 comment=defconf dns-server=8.8.8.8,8.8.4.4
gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=213.57.XX.XX comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=accept chain=input comment=winbox dst-port=8291 protocol=tcp
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=forward dst-address=192.168.1.15 dst-port=80
in-interface=bridgeWAN protocol=tcp
add action=accept chain=forward dst-address=192.168.1.15 dst-port=8080
in-interface=bridgeWAN protocol=tcp
add action=accept chain=forward dst-address=192.168.1.15 dst-port=8000
in-interface=bridgeWAN protocol=tcp
add action=drop chain=input comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
add action=dst-nat chain=dstnat dst-port=80 in-interface=bridgeWAN
protocol=tcp to-addresses=192.168.1.15 to-ports=80
add action=dst-nat chain=dstnat dst-port=8000 in-interface=bridgeWAN
protocol=tcp to-addresses=192.168.1.15 to-ports=8000
add action=dst-nat chain=dstnat dst-port=8080 in-interface=bridgeWAN
protocol=tcp to-addresses=192.168.1.15 to-ports=8080
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=
192.168.1.15 to-ports=8000
add action=dst-nat chain=dstnat dst-port=554 in-interface=bridgeWAN
protocol=tcp to-addresses=192.168.1.15 to-ports=554
add action=dst-nat chain=dstnat dst-port=554 protocol=udp to-addresses=
192.168.88.49
/ip route
add distance=1 gateway=213.57.XX.XX
/system clock
set time-zone-name=Asia/Jerusalem
/system identity
set name=Mattrelo
/system ntp client
set enabled=yes primary-ntp=46.19.96.19 secondary-ntp=192.46.211.253
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN