please help. what is it? and what should i do?

I read port 25 and 587, looks like someone/something is trying to connect to it. Do you have a mail server behind the router? Unfortunately your screenshot isn't showing the source IP address clearly, therefor can't say who is doing this.

If you are not running a mailserver, you might want to blokck this IP. But looking at the dstnat it looks like a port forward (that is logging).Turning off logging is the easiest way to solve it.

There is something you can do:)

• Whitelist access for your specific IPs. That's what firewalls are for, not just logging.
• Auto add such attempts to "address-list" and drop such connections from recorded address-list in "/ip raw"
• Disable logging and forget.

Though I fully agree, erkexzcx, first we have to know if this is unwanted.

It seems a whole /24 subnet of source addresses: 45.142.120.0/24 ... and occasionally some other src-address ... if this is gateway to a typical home network, then dst-ports are suspicious: plain sever-to-server SMTP (TCP port 25) and SMTP submission (TCP 587). If OP is not running kind of public email service then he should block these ports (without logging not to clobber the log).

I read port 25 and 587, looks like someone/something is trying to connect to it. Do you have a mail server behind the router? Unfortunately your screenshot isn't showing the source IP address clearly, therefor can't say who is doing this.

If you are not running a mailserver, you might want to blokck this IP. But looking at the dstnat it looks like a port forward (that is logging).Turning off logging is the easiest way to solve it.

yes i am using kerio connect-mail server behind router. thanks for answer. but why there is a different ports in source ip address? like 50178, 14120,58546,10858,64548 and so on every time different ports . please look after source ip 45.142.120.xx

Port numbers are always the same on server's side (and are standard/well known). Port numbers on clients' side (source port in your case) are random and different each time, this is completely normal. What makes thing suspicious is number of clients conecting from same IP subnet, sometimes it indicates some DoS attack or attempts to abuse service. However if you're running service intended for clients in that IP subnet, then even this part is just fine.

/export hide-sensitive file=anynameyouwish

A view of the config may provide some clues.......

It seems a whole /24 subnet of source addresses: 45.142.120.0/24 ... and occasionally some other src-address ... if this is gateway to a typical home network, then dst-ports are suspicious: plain sever-to-server SMTP (TCP port 25) and SMTP submission (TCP 587). If OP is not running kind of public email service then he should block these ports (without logging not to clobber the log).

thanks. i misunderstood something. why source ports are all different but in destination the same 25 or 587?? . and how can i block the whole subnet. ?
i just created address list with 45.142.120.0/24 then blocked it with firewall filter forward rule. but same log appears

Filter rules are matched from top to bottom. You want to push your blocking rule high on the list.

I've already explained the ports in my previous post.

less frigging with your config please so that you can take the 10 seconds to post your config.
Trying to pinpoint a grain of sand on a beach is no fun.