/ip firewall filter
add action=accept chain=forward dst-address=172.26.0.4 dst-port=80 protocol=tcp
add action=accept chain=forward dst-address=10.0.0.3 dst-port=22 protocol=tcp
add action=accept chain=input in-interface=ether1 protocol=udp src-port=\
    1701,500,4500
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
/ip firewall mangle
add action=mark-packet chain=prerouting disabled=yes dst-port=8443 \
    in-interface=ether1 log=yes new-packet-mark=client2443 passthrough=yes \
    protocol=tcp
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=8443 in-interface=ether1 log=yes \
    protocol=tcp to-addresses=172.26.0.4 to-ports=80
add action=dst-nat chain=dstnat dst-port=2222 in-interface=ether1 log=yes \
    protocol=tcp to-addresses=10.0.0.3 to-ports=22