Port forwarding from WAN to host connected via OpenVPN

Mikrotik via OpenVPN have IP 10.123.37.55
Remote host IP 10.123.37.1. (FreeBSD)


I’m testing

/system telnet address=10.123.37.1 port=25                                                                                             
Trying 10.123.37.1...
Connected to 10.123.37.1.
Escape character is '^]'.
220 HOSTNAME ESMTP
quit
221 2.0.0 Bye
Connection closed by foreign host.

I get on FreeBSD

# tcpdump -ni tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type NULL (BSD loopback), capture size 65535 bytes
08:16:40.062135 IP 10.123.37.55.53643 > 10.123.37.1.25: Flags [S], seq 1854403569, win 14600, options [mss 1287,sackOK,TS val 4386140 ecr 0,nop,wscale 4], length 0
08:16:40.062197 IP 10.123.37.1.25 > 10.123.37.55.53643: Flags [S.], seq 872619366, ack 1854403570, win 65535, options [mss 1460,nop,wscale 6,sackOK,TS val 3469131112 ecr 4386140], length 0
08:16:40.107772 IP 10.123.37.55.53643 > 10.123.37.1.25: Flags [.], ack 1, win 913, options [nop,nop,TS val 4386144 ecr 3469131112], length 0
08:16:40.108932 IP 10.123.37.1.25 > 10.123.37.55.53643: Flags [P.], seq 1:22, ack 1, win 1035, options [nop,nop,TS val 3469131158 ecr 4386144], length 21
08:16:40.154398 IP 10.123.37.55.53643 > 10.123.37.1.25: Flags [.], ack 22, win 913, options [nop,nop,TS val 4386149 ecr 3469131158], length 0
08:16:42.356266 IP 10.123.37.55.53643 > 10.123.37.1.25: Flags [P.], seq 1:7, ack 22, win 913, options [nop,nop,TS val 4386369 ecr 3469131158], length 6
08:16:42.356744 IP 10.123.37.1.25 > 10.123.37.55.53643: Flags [P.], seq 22:37, ack 7, win 1035, options [nop,nop,TS val 3469133407 ecr 4386369], length 15
08:16:42.356784 IP 10.123.37.1.25 > 10.123.37.55.53643: Flags [F.], seq 37, ack 7, win 1035, options [nop,nop,TS val 3469133407 ecr 4386369], length 0
08:16:42.402296 IP 10.123.37.55.53643 > 10.123.37.1.25: Flags [.], ack 37, win 913, options [nop,nop,TS val 4386374 ecr 3469133407], length 0
08:16:42.448183 IP 10.123.37.55.53643 > 10.123.37.1.25: Flags [F.], seq 7, ack 38, win 913, options [nop,nop,TS val 4386379 ecr 3469133407], length 0
08:16:42.448264 IP 10.123.37.1.25 > 10.123.37.55.53643: Flags [.], ack 8, win 1035, options [nop,nop,TS val 3469133498 ecr 4386379], length 0

I added to mikrotik:

/ip firewall nat add action=dst-nat chain=dstnat dst-address=WAN_IP dst-port=25 protocol=tcp to-addresses=10.123.37.1 to-ports=25

When I connect from internet -

telnet WAN_IP 25

Any packet on 10.123.37.1 (FreeBSD) I not received. ( tcpdump -ni tun0 )

tcpdump -ni tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type NULL (BSD loopback), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

What did I do wrong?