Simple firewall rules for what you want:
(assuming an empty firewall rule set to begin)
/ip firewall nat
add chain=dstnat protocol=tcp dst-port=80,443 dst-address-type=local dst-address=!192.168.0.0/24 action=dst-nat to-address=192.168.0.254
add chain=srcnat action=masquerade out-interface=ether1
add chain=srcnat action=masquerade out-interface=bridge src-address=192.168.0.0/24
/ip firewall filter
add chain=input action=accept connection-state=established,related
add chain=input action=accept protocol=icmp
add chain=input action=accept in-interface=bridge
add chain=input action=drop
add chain=forward action=fasttrack-connection connection-state=established,related
add chain=forward action=accept connection-state=established,related
add chain=forward action=accept out-interface=ether1
add chain=forward action=accept connection-nat-state=dstnat
add chain=forward action=drop
This will allow webfig access to the router’s LAN interface, but dstnat ports 80 and 443 if the destination IP is on the router itself. (dynamic IP means you can’t just specify a dst-address, and hairpin means you can’t say in-interface=ether1). If you want to access the router’s webfig remotely (bad idea to leave this open), on a non-standard port w/o changing the ports the service actually listens on:
/ip firewall nat
chain=dstnat in-interface=ether1 protocol=tcp dst-port=4343 action=redirect to-ports=443
chain=dstnat in-interface=ether1 protocol=tcp dst-port=8080 action=redirect to-ports=80
(you would also need to create a rule in the filter’s input chain which allows dst-port=80,443 and place it before the default drop rule)
In this case, you use the standard ports 80 and 443 while accessing your router from the LAN, and you use 8080/4343 to reach http/https ports from the public Internet.
