How to change source ip address in mikrotik?

Question

network hardware

All the best!
There is the following scheme:
1. External resource with IP address 9.9.9.9 with which the server will exchange packets - denoted by "ISP"
2. Mikrotik with internal IP address 10.0.0.1 (firmware version 5.26) - denoted by "M"
3. Server inside Mikrotik network with address 10.0.0.2 - denoted by "S"
4. Traffic from the ISP goes to the internal address 20.0.0.2 through the gateway 20.0.0.1 - denoted "Sh"
5. Physically M is connected to S, M is assigned the address 20.0.0.2 from subnet W
Task: it is
necessary that packets from ISP come to port M with address 20.0.0.2 and be translated to S with address 10.0.0.2.
ISP(9.9.9.9) --> W(20.0.0.1) --> M(20.0.0.2) <--> M(10.0.0.1) --> S(10.0.0.2).
What has been done:
1.
2. S sees ISP and packets go there
3. packets come from ISP to M, but then stop! - nothing goes to S
4. the following did not work in the NAT table:
/ip firewall nat add chain=dstnat dst-address=20.0.0.2 action=dst-nat to-addresses=10.0.0.2
/ip firewall nat add chain=srcnat src-address=10.0.0.2 action=src-nat to-addresses=20.0.0.2
5. netmap didn't help either (by analogy)
6. I tried to enable marking as follows
/ip firewall mangle
add action=mark-routing chain=prerouting new -routing-mark=isp src-address=9.9.9.9 dst-address=20.0.0.2
and enable dst-nat by this condition. Result - I see packets on the Mikrotik interface, nothing comes to S!
Help, good people - where to dig?

Answer 1

Good afternoon!
First, it’s worth talking more about Sh. How and what kind of traffic from it gets to M? Did someone set up dst-nat on W? If so, how and with what rules.
Without explaining this, it is not clear what happens to the traffic in the chain W(20.0.0.1) --> M(20.0.0.2)
Well, then it is desirable to see the routing tables M and S.
This rule does not show what type of traffic you want to broadcast. Not all.
/ip firewall nat add chain=dstnat dst-address=20.0.0.2 action=dst-nat to-addresses=10.0.0.2
And besides, the firewall settings are not specified (whether all traffic is allowed or are there blocking rules)
As far as I understand, S only listens for incoming connections, so this rule does not need to be set. If M serves as a gateway for S, then the rule must be changed so that all traffic, except for the local one, is subjected to src-nat (specify the masquerade in the action, and also specify the port to S as Out-int).
/ip firewall nat add chain=srcnat src-address=10.0.0.2 action=src-nat to-addresses=20.0.0.2
But it is important who S is registered as the gateway, its routing table.
It is desirable to dump to M:
/ip firewall export compact
/ ip route print
On S:
route print
or Linux equivalent if S is not windows
AND on W port forward settings, if possible