Why doesn't port forwarding work?

Question

Computer networks

Hello everyone, this is the situation.
There is a local network 172.16.0.0/12. A microtic with IP 172.19.172.5 is connected to it, it has its own network 192.168.0.0/24
. Inside it there is Synology, on the webcam of which I go to 192.168.0.4:5000. You need to set up access to this Synology from the network 172.16.0.0/12 through port forwarding.

The NAT rule is configured according to the standard manual:

chain=dstnat action=netmap to-addresses=192.168.0.4 to-ports=5000 protocol=tcp in-interface=ether1 dst-port=5000 log=yes log-prefix="nas"

All Firewall rules are disabled. There is a NAT rule for masquerade:

chain=srcnat action=masquerade src-address=192.168.0.0/24 out-interface=ether1

When trying to access from the local network 172.16.0.0/12 to 172.19.172.5:5000, the following comes out in the logs:

nas dstnat: in:ether1 out:(unknown 0), src-mac 1:1:1:1:1:1, proto TCP (SYN), 172.19.118.3:55164->172.19.172.5:5000, len 52

Mikrotik itself is available from the local network (pings from the device).
What is my mistake and trouble?

I googled for a long time, but the tips that I found did not help.

Answer 1

Found and eliminated on December 31, but there was no time to unsubscribe. If suddenly someone is interested, then here)
Synology has 2 Ethernet interfaces, 192.168.0.0/24 subnet was configured on LAN1, 172.16.0.0/12 subnet was temporarily configured on LAN2. This, in fact, was the problem.
After disconnecting LAN2, redirection began to work correctly. I suppose the redirection itself worked anyway, but the response packets from the NAS did not go there, but via LAN2.

Answer 2

I could be wrong, but the rule needs to be removed
to-addresses=192.168.0.4
. on the 172.16.0.0/12 network, hardly anyone knows anything about this network, they should connect to 172.16.172.5:5000.
netmap is also redundant here, I would change it to dst-nat.
PS
Even at first I thought 172. 19 .172.5 is a typo, but below in the text again 19 or is it a typo twice?

Answer 3

Take a traffic dump. It is likely that you do not have a route on the device to a given network, or it blocks all requests from outside its network with its screen, for example, WD NAS behaves this way by default.
In the log, everything is normal at first glance, this is a SYN packet, i.e. attempt to establish a tcp session fails.

Answer 4

why is it so difficult? what does NAT and masquerading have to do with it, and why natit the entire network? it is enough to register a route for each of the two addresses on IMHO