Not an answer to your question, but
[*] never open opp 8192 from internet to admin your router. You asking for problems.
add action=accept chain=input dst-port=8291 protocol=tcp
See this post: http://forum.mikrotik.com/t/remote-access/150805/2
set winbox address=192.168.1.0/24 This helps some. Edit FW rule to only accept LAN
[*] Inside IP should be bound to bridge, not to an interface part of the bridge:
wrong
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether2 network=192.168.1.0
correct (same as you already has bound your DHCP server to)
/ip address
add address=192.168.1.1/24 comment=defconf interface=bridge network=192.168.1.0
[*] Edit and remove serial number from your post, with that I found your ip to be 103.x.x.x3 du to cloud service, and with Winbox open, I can just start hacking.
[*] Nothing wrong but, to-ports are not needed in NAT if its the same as dst-port
To test your NAT (tcp part) visit https://canyouseeme.org/ and type in port 1212