Thanks, I've had a look at that, but I've already tried something very similar and there's just no traffic going through that rule. Tried again following that guide, but still nothing.
Using the Ping tool in winbox, I realized I can't ping from Eth2 to the internal ip address I want to forward the traffic to. I suspect that is why this rule doesn't work, since it can't reach the internal IP address. Am I right in thinking that I first need to get the traffic forwarded to Eth5 - where the VM host is connected?