but you also need to allow it on your forward chain if you use a default drop
Sorry, I don't understand...
I thought that inserting NAT rule would automatically open port in firewall...
If I use dst-nat for port 1234, should I manually open that port in firewall?
Can you provide me an example?
Sorry for dumb questions, but I'll have little time to test my setup in the real world, so I need to "be prepared" 
EDIT: as seen on Dstnat rules - server logs reporting access from router's IP
you should also create allow rules before the drop rule for the system that needs to be access from the outside.
Keep in mind that dst-nat will occur before filter, so your filter should contain the dst-nat rule to-address IP.
...
chain=forward action=accept protocol=tcp dst-address=192.168.1.3 dst-port=22 in-interface=
So:
Router and internal network protection, no internal servers, LAN is friendly
Firewall rules - Beginner Basics - MikroTik community forum
modified not allowing icmp, bridge-local as in-interface, added logging
Dstnat rules - server logs reporting access from router's IP - Beginner Basics - MikroTik community forum
dst-nat will occur before filter, so filter should contain the dst-nat rule to-address IP
/ip firewall filter
add chain=input action=drop connection-state=invalid comment="Block invalid connections"
add chain=input action=accept connection-state=new in-interface=bridge-local comment="Allow access to router and Internet only from LAN"
add chain=input action=accept connection-state=established comment="Allow established connections"
add chain=input action=accept connection-state=related comment="Allow related connections"
add chain=input action=log log-prefix="FW INPUT DROP: " disabled=yes comment="Log everything else"
add chain=input action=drop comment="Drop everything else"
add chain=forward action=drop connection-state=invalid comment="Block invalid connections"
add chain=forward action=accept connection-state=new in-interface=bridge-local comment="Allow access to router and Internet only from LAN"
add chain=forward action=accept connection-state=established comment="Allow established connections"
add chain=forward action=accept connection-state=related comment="Allow related connections"
add chain=forward action=accept protocol=tcp dst-address=ADDRESS_TO_DSTNAT dst-port=PORT_TO_DSTNAT in-interface=ether1-gateway comment="Allow NAT"
add chain=input action=log log-prefix="FW FORWARD DROP: " disabled=yes comment="Log everything else"
add chain=forward action=drop comment="Drop everything else"
dstnat for cameras
/ip firewall nat add chain=dstnat dst-port=PORT_ON_WAN action=dst-nat protocol=tcp to-address=IP_ON_LAN to-port=PORT_ON_LAN