SSH port forwarding doesn't work

RouterOS Forwarding Protocols
1

Hello everybody,

There is Qnap nas in my network it runs Gitea server and listens 22 port to accept SSH connections.
I want to listen 22 from my WAN and forward it to 192.168.15.50:22 again. But it doesn’t works.

When i change the ports to 222 everything works. What is the problem?

# 2024-03-31 18:18:35 by RouterOS 7.14.2
# software id = **ELIDED**
#
# model = RB4011iGS+
# serial number = **ELIDED**
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="WinBox izin" connection-nat-state="" connection-state=new connection-type="" disabled=yes dst-port=8291 in-interface-list=WAN protocol=tcp tcp-flags=""
add action=accept chain=input comment="NAS SSH" disabled=yes dst-port=8022 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="Gitea SSH" dst-port=22 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="OpenVpn Server " dst-port=11949 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="OpenVpn LAN" src-address=10.15.15.0/24
add action=accept chain=input comment=Nginx dst-port=80,443 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=Mosquitto dst-port=1883 in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=Deka disabled=yes out-interface=deka_ovpn_client
add action=masquerade chain=srcnat comment="Efe Apt." disabled=yes dst-address=192.168.2.0/24 ipsec-policy=out,none out-interface=ovpn-asus
add action=dst-nat chain=dstnat comment="Torrent Ports" in-interface-list=WAN protocol=udp to-addresses=192.168.15.50 to-ports=6881-6889
add action=dst-nat chain=dstnat comment="Nginx Http" dst-port=80 in-interface-list=WAN protocol=tcp to-addresses=192.168.15.50 to-ports=80
add action=dst-nat chain=dstnat comment="Gitea SSH" dst-port=22 in-interface-list=WAN protocol=tcp to-addresses=192.168.15.50 to-ports=22
add action=dst-nat chain=dstnat comment="Nas SSH" disabled=yes dst-port=8022 in-interface-list=WAN protocol=tcp to-addresses=192.168.15.50 to-ports=8022
add action=dst-nat chain=dstnat comment="Nginx Https" dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=192.168.15.50 to-ports=443
add action=dst-nat chain=dstnat comment=Mosquitto dst-port=1883 in-interface-list=WAN protocol=tcp to-addresses=192.168.15.50 to-ports=1883
2

Let me guess. Your router ssh is listen on port 22?
show your

/ip/services/print
3 
Flags: X - DISABLED, I - INVALID
Columns: NAME, PORT, CERTIFICATE, VRF
#   NAME     PORT  CERTIFICATE  VRF 
0 X telnet     23               main
1 X ftp        21                   
2 X www        80               main
3 X ssh        22               main
4 X www-ssl   443  none         main
5 X api      8728               main
6   winbox   8291               main
7 X api-ssl  8729  none         main

no it is disabled.

Similarly i can not access my router with winbox over port 8291. i am using vpn to remote accsess

4 
add action=accept chain=input comment="Gitea SSH" dst-port=22 in-interface-list=WAN protocol=tcp

remove this

5

it doesn’t work

6

would need to see the complete config
/export file=anynameyouwish ( minus router serial#, any public WANIP information, keys etx.)