You have a service on your LAN — a camera, a web server, a game server — that you need to reach from outside your network, and the router in front of it only has one public IP. Port forwarding maps a specific port on that public IP to a specific device and port inside your LAN, without exposing anything else.
Identify the public IP and the internal target
Find which interface holds your public IP (/ip address print) and the LAN IP:port of the service you want to reach, e.g. 192.168.88.20:80.
Add the dst-nat rule
/ip firewall nat add chain=dstnat protocol=tcp dst-port=8080 action=dst-nat to-addresses=192.168.88.20 to-ports=80This forwards anything hitting the router on TCP 8080 to port 80 on 192.168.88.20.
Allow the forwarded traffic in the filter chain
dst-nat alone doesn't open the firewall — RouterOS still evaluates the forward chain separately.
/ip firewall filter add chain=forward protocol=tcp dst-port=80 dst-address=192.168.88.20 action=acceptRestrict the source if you can
If only a handful of IPs need access, add src-address (or a src-address-list) to the dst-nat rule instead of leaving it open to the world — same idea as restricting management ports.
Test from outside your network
Use a phone on mobile data (not your own Wi-Fi) or an online port checker to confirm the forwarded port actually answers.
Why do it this way
dst-nat exposes exactly one internal port to the internet instead of putting the device directly on the public IP — everything else on that LAN stays unreachable from outside. Combining it with a src-address restriction (step 4) closes the gap a bare port forward leaves open: anyone in the world can reach it by default, so scoping it to known sources whenever possible removes most of the incidental scanning traffic before it ever reaches your service.
How MoniTik helps
MoniTik doesn't need any port forwarded to reach your router — it's the exact opposite model, an outbound tunnel instead of an inbound rule. If you're setting up port forwarding just to reach WinBox on the router itself (rather than another device on the LAN), you don't need this at all: that's precisely what MoniTik's remote WinBox already gives you, without a NAT rule to maintain or a port to worry about someone else finding.
Santiago spends his days on rooftops and in racks, keeping MikroTik links online for local ISPs.