How to restrict access to the forwarded port by the MAC address of the client in Mikrotik?

Question

Mikrotik

The bottom line is that there is Mikrotik with a white ip and forwarded ports that look at the server to the internal LAN, you need to give access to the ports only to a couple of clients by MAC addresses from the outside, and the rest should be prohibited from connecting to the ports.

Answer 1

By poppy address will not come out. It's not that level. It is possible to resolve by ip (but then who will need access - it will be necessary to have static ip), but it is better to raise vpn for such things.

Answer 2

/ip firewall nat
add action=dst-nat chain=dstnat dst-port=3389 protocol=tcp src-mac-address=52:54:00:34:3A:70 to-addresses=192.168.88.203

but it won't work like that, check
if you can filter by ip

/ip firewall nat
add action=dst-nat chain=dstnat dst-port=3389 protocol=tcp src-address-list="IP ALLOW" to-addresses=192.168.88.203

/ip firewall address-list
add address=216.17.43.160 comment="one ip" list="IP ALLOW"