nat to a server at local

RouterOS Beginner Basics
1

I have RB1200 and configured as 4 wan load balancing...
only 1 wan is connected (wan2) it now but ports are ready....
I have a hotspot interface (my customers use) and a local interface (that my offices use)
they are all connected to WAN2 as I mentioned.
My hotspot is 70.70.1.* and my LOCAL is 192.168.2.*
I have a linux server that my hotel software runs.
that is 192.168.2.100
I want to nat port 22 and 5632
Here is my configuration

[admin@MikroTik] /ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough

1 chain=srcnat action=masquerade out-interface=WAN1

2 chain=srcnat action=masquerade out-interface=WAN2

3 chain=srcnat action=masquerade out-interface=WAN3

4 chain=srcnat action=masquerade out-interface=WAN4

5 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=70.70.0.0/18

\

[admin@MikroTik] /ip firewall filter> print all
Flags: X - disabled, I - invalid, D - dynamic
0 D chain=forward action=jump jump-target=hs-unauth hotspot=from-client,!auth

1 D chain=forward action=jump jump-target=hs-unauth-to hotspot=to-client,!auth

2 D chain=input action=jump jump-target=hs-input hotspot=from-client

3 D chain=input action=drop protocol=tcp hotspot=!from-client dst-port=64872-64875

4 I chain=hs-input action=jump jump-target=pre-hs-input

5 D chain=hs-input action=accept protocol=udp dst-port=64872

6 D chain=hs-input action=accept protocol=tcp dst-port=64872-64875

7 D chain=hs-input action=jump jump-target=hs-unauth hotspot=!auth

8 D chain=hs-unauth action=reject reject-with=tcp-reset protocol=tcp

9 D chain=hs-unauth action=reject reject-with=icmp-net-prohibited

10 D chain=hs-unauth-to action=reject reject-with=icmp-host-prohibited

11 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough

admin@MikroTik] /ip> address print
Flags: X - disabled, I - invalid, D - dynamic

ADDRESS NETWORK INTERFACE

0 10.10.1.2/24 10.10.1.0 WAN1
1 20.20.1.2/24 20.20.1.0 WAN2
2 30.30.1.2/24 30.30.1.0 WAN3
3 40.40.1.2/24 40.40.1.0 WAN4
4 70.70.1.1/18 70.70.0.0 WIFI
5 192.168.2.1/24 192.168.2.0 LOCAL

Please Help me
Thanks....

2

You need to add dst-nat rules (AKA port forwarding) to your internal machine for ports 22 and 5632 and it will work (assuming you need TCP on both, change as appropriate):

/ip firewall nat add action=dst-nat chain=dstnat dst-port=22 \
    in-interface=wan2 protocol=tcp to-addresses=192.168.2.100

/ip firewall nat add action=dst-nat chain=dstnat dst-port=5632 \
    in-interface=wan2 protocol=tcp to-addresses=192.168.2.100

If you omit the in-interface parameter it will happen for all interfaces.