How to organize access to an intranet resource via an external link?

Question

Domain Name System

It was difficult to form your question in one application for the title, so now I will write in more detail.
Let's say there is a network 192.168.1.0/24 in the network:
192.168.1.1 - Gateway (Mikrotik)
192.168.1.2 - RDP Server (Windows 2008)
...
192.168.1.100 - Client (WIndows 7)
The router has an external static IP to which it is attached domain like 1c.site.com. Port forwarding is configured on the router 1c.site.com:8888 -> 192.168.1.2:3389. Therefore, clients outside have no problem connecting to RDP. But when the same client is inside the network, he can no longer connect to 1c.site.com:8888. Of course, you can create a separate shortcut to 192.168.1.2:3389, but this solution is not universal and should be a more beautiful solution.
Therefore, I'm interested in a few questions:
1 - Tried to set up an internal DNS but could not get to change the port. As I understand it, this problem cannot be solved using DNS
2 - I tried to set up port forwarding, but I probably couldn’t figure it out, now port forwarding only works if they are accessed from outside, see screenshots
3 - Maybe this problem is generally solved by not the methods that I think about?

PS RDP is taken only as an example, in fact, we are talking about a wide variety of services: RDP, DVR, Web resources, etc.

Answer 1

Hairpin NAT .

Answer 2

I understand that the example implies that users are rummaging around with their laptops, etc. in free float mode?
then I think it's easier to do this:
/ip firewall mangle>
add chain=prerouting dst-address=1c.site.com d-port=8888 in-interface=bridge-local action=mark-connection new-connection-mark=to-rdp -from-local-conn
add chain=prerouting dst-address=1c.site.com d-port=8888 in-interface=bridge-local action=mark-packet new-packet-mark=to-rdp-from-local- pkt
once RDP is taken as an example
and then with firewall filters to overtake such a user where required)

Answer 3

After I received a practical answer to my question in principle, I had a theoretical question. Is the method proposed by me and implemented at the prompt throughtheether optimal for solving this problem? After all, now every time, even when working from within the network, clients will load the router processor with their traffic?
Let me remind you that initially the task was to organize access to an intranet resource using a unique address:port pair both from inside the network and from outside.