Are NAT rules executed before Filter rules, or do they “fire” in the order listed with EXPORT?
DST nat rules are executed before any filter rule, in the prerouting chain… SRC nat Rules are in the postrouting chain, so after the output filter rules…
https://wiki.mikrotik.com/wiki/Manual:Packet_Flow
From a user case point of view (vice general answer), for port forwarding (destination nat), the (dst)NAT rule is executed first (as technically described in the post above). It is in the NAT rule where MT users typically do any port translation and delineate which IP address the traffic is heading too. Normally only one filter rule is used to allow one or all port forwarding rules through the firewall after the NAT processing. This may be different from your previous router. The nuances I have come across are that on a scan of your router IP, the ports(incoming) you have identified on the NAT rule are visible and closed. IF, on the NAT rule you also put in a list of authorized user(s) (firewall list typically) as an entry in SOURCE ADDRESS or if more than one, SOURCE ADDRESS LIST, then no ports are visible on a scan of your routers IP.