Heya, I have just set up a CCR2004 - it is working quite fine. I followed the guide under https://help.mikrotik.com/docs/display/ROS/Building+Advanced+Firewall and this is also doing it’s job. Now I want to gain access to a machine in the routers network via srcNAT. Hence I gave it the following rule:
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=12345 in-interface-list=WAN protocol=tcp src-address=1.2.3.4 to-address=4.3.2.1 to-ports=22 and it is not working. Do I do something wrong here?
Btw, IP-addresses and portnumbers are just examples, I actually use different ones…
Not working is a bit arbitrary, what exactely is not working and how do you test it?
Seems the port forward you created is correct, did you change anything in the default firewall?
Could you please add your config?
/export file=anynameyoulike
Remove serial and any other pricate information.
Well… I feel kinda bad about this, turns out: without default route on the target it cannot work. And this has nothing to do with the firewall or the NAting, just with my own stupidity. Sorry, solved.
I think we all have been there 
Glad it is solved!