hello,

i have rb110ahx2, routeros ver 6.30.4
trying to forward 80 and 25 port to host inside lan. every time i try to reach it (80 port for example) i see syn_recv on host behind NAT, but nothing else. i even added forward rule with dst port 80 and 25.
nat:
0 chain=dstnat action=netmap to-addresses=192.168.0.11 to-ports=80 protocol=tcp dst-address=X.X.X.X dst-port=80 log=yes log-prefix="WWW"

1 chain=dstnat action=netmap to-addresses=192.168.0.11 to-ports=25 protocol=tcp dst-address=X.X.X.X dst-port=25 log=yes log-prefix="SMTP"

2 chain=srcnat action=masquerade out-interface=ISP log=no log-prefix=""

in IP/Settings i enabled TCP SynCookies

Any thoughts, please help.

i changed
chain=srcnat action=masquerade out-interface=ISP log=no log-prefix=""
to
chai=srcnat action=src-nat to-addresses=X.X.X.X
X.X.X.X is static IP provided by ISP

on host machine behind nat i can easily reach any internet address (def. gateway is mikrotik ip)
i have no blocking forward rule regarding 80 port, only blocking invalid traffic.
please, help. it drives me crazy...

Think you should be using action=dst-nat instead of netmap.
Make sure you're not dropping or are explicitly forwarding connection-nat-state=dstnat in your filters forward chain.

i tried dst-nat instead of netmap, same result.
i check connection-nat-state=dstnat, but didn't find one in my rules, everything is clear.
i tried to open 21 port same way, but ftp server tells me clear: "couldn't send reply, disconnected."
any thoughts? if isp would be blocking port, i wouldn't see even that message, right?

Do you have forward rules accepting traffic for those ports between WAN and LAN and back?

yeah i have forwarding rules wan->lan and lan->wan but still nothing happens. i see something is going through based on counters and torch and on host (tcpdump). but i get only "syn_recv" state and no "established". i already called my isp, may be they're blocking, but it'd be strange as i'd have nothing in counters and no "syn_recv" on host and router.

i fixed issue, isp was blocking almost all common ports. but now i can't dst-nat 443 and 25 ports, at the same time 80 port is working well.

fixed that as well,by creating forward rule,although dst-nat for 80 port didn't need that rule.

If you put in a single accept of connection-nat-state=dstnat in your filters forward chain you won't have to duplicate every dstnat port in the filters section.