Access to local PC services from outside from the first provider, provided that all traffic goes through the second one?

Question

Iron

Good people who know tell me pliz. I just can’t figure it out (
Mikrotik hAP ac Lite
The situation is as follows: I have static on my Mikrotik, I turned all the traffic through a friend, the same provider, he has a gray IP, they did L2TP with a default route. Everything works fine.
Because now I for nat, I needed the ability to get to my router from the outside.I
decided like this:

[email protected]] /ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
3 chain=input action=mark-connection new-connection-mark=ISP1 -> Input passthrough=yes
in-interface=ether1 log=no log-prefix=""
4 chain=output action=mark-routing new-routing-mark=ISP1 passthrough=no connection-mark=ISP1 -> Input
log=no log-prefix=""

There is excellent access.
But then another problem arose, I just can’t get to the internal services of my PC.
On the PC, there is an HTTP File Srver running on port 85, sometimes I distribute files to people through it.
I rummaged through a bunch of information in the end I did this:
[

[email protected]] /ip firewall mangle> print
Flags: X - disabled, I - invalid, D - dynamic
5 chain=forward action=mark-connection new-connection-mark=in_wan1_for passthrough=yes protocol=tcp
in-interface=ether1 dst-port=85 log=no log-prefix=""
6 chain=prerouting action=mark-routing new-routing-mark=ISP1 passthrough=no connection-mark=in_wan1_for
log=no log-prefix=""

/ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""
1 chain=srcnat action =masquerade out-interface=l2tp-out1 log=no log-prefix=""
3 ;;; hpfs
chain=dstnat action=dst-nat to-addresses=192.168.30.150 to-ports=85 protocol=tcp in-interface=ether1
dst-port=85 log=no log-prefix=""

I start the server on a PC, I try to log in from the phone through my external IP, in the server log I see that there is a connection, but the server itself does not open on the phone, if I wait 10 minutes it will hardly open, I will even see the files when I try to download the server in the logs Writes that the download has begun and the traffic does not go further, downloading the file on the phone is also a stake.
It seems that the input works, but the output does not.
Tell me who can, there is not enough knowledge to master (

Answer 1

So for this socket for 10 years, probably nothing has been released

Answer 2

Problem solved. Disconnected fasttrack connection and everything flew, internal services started working.

Answer 3

Keywords tcp mss. Smoke the dock.