I would use /interface bridge filter and /interface bridge nat rules instead, as described here. Don’t miss the last post!