How to forward Mikrotik ports?

Question

network hardware

There is a MikroTik rb2011UiAS-2HnD router. Just today it was unpacked and started to install. The Internet has appeared in the entire organization, everything is OK, but it’s impossible to forward the port to our server where the site is installed (port 80)
There is an external IP 94.24.253.22 (Eth 1)
a hub with many connections is connected to Eth 2, including the site
AND internal (where the site is located) 10.102.10.32 Climbed
on the Internet, did everything according to the instructions. I don't understand what I'm doing wrong. I did everything as it should, at first access via an external IP led to the web interface of the router, but I fixed it and changed the port. It seems that everything was done correctly, but the site does not open. Help, I don't know where to dig anymore... I'm ready to provide any screenshots from the sections

Answer 1

Usually, this requires two rules to be written (at least with settings generated via Quick Set). You did one thing (actually port forwarding in IP -> Firewall -> NAT). The second rule must be written in IP -> Firewall -> Filter, in the forward chain, it must allow traffic from the external interface to the server's internal IP address on the desired port, and be higher than the default rule that prohibits traffic from the external interface to internal interfaces or ip addresses.

Answer 2

on the server the gateway is specified?

Answer 3

/ip firewall nat
add action=dst-nat chain=dstnat comment="Allow any to our webserver" dst-address=1.2.3.4 dst-port=\
    80,443 in-interface=ether1 protocol=tcp to-addresses=10.4.1.1

Something like that.
It reads like this - "if the packet came to IP 1.2.3.4, to port 80 or 443 via the ether1 interface, then forward it to the address 10.4.1.1 on the same port"

Answer 4

Here's another extra. screen

Answer 5

We have already written above what is needed in addition to the port forwarding rule, it is necessary to register in the forward chain so that the system passes traffic that satisfies the condition:
- incoming address / port on the external interface
- destination = your server
I advise you to temporarily (!) add logging to each rule ( the log checkbox in Winbox, or the log and log-prefix parameters in the console) and add a prefix so that you can see the traffic from the log and track the execution of the rule. You can also reset traffic counters to see how specific rules work to increase this counter.

Answer 6

The 80th port on Mikrotik is occupied by the web interface by default, therefore:
# Change the port of the web interface and generally turn it off
/ip service set 2 port=8080 disabled=yes
# Rule allowing connection from outside

/ip firewall filter
add action=accept chain=forward comment=WEB dst-address=10.102.10.32 \
    dst-port=80,443 protocol=tcp

#And raise it higher
/ip firewall filter move [find comment="WEB"] 0
# NAT rule

/ip firewall nat
add action=netmap chain=dstnat comment=WEB dst-port=80,443 \
    in-interface=ether1 protocol=tcp to-addresses=10.102.10.32