====== Проброс портов внутрь локалки ======
<code bash>
  [admin@MikroTik] > /ip firewall nat add chain=dstnat dst-address=77.34.8.94 protocol=tcp dst-port=3389 
  action=dst-nat to-addresses=192.168.9.33 to-ports=3389
</code>

Посмотрим, что получилось:
<code bash>
  [admin@MikroTik] > /ip firewall nat export 
  # jan/02/1970 11:07:00 by RouterOS 6.0rc14
  # software id = 9VH0-M2X5
  #
  /ip firewall nat
  add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway \
    to-addresses=0.0.0.0
  add action=dst-nat chain=dstnat dst-address=77.34.8.94 dst-port=3389 protocol=tcp \
  to-addresses=192.168.9.33 to-ports=3389
</code>