添加DNAT机器，没有指定网关为routeros的内网机器,需要添加一条snat
/ip firewall nat add chain=dstnat \
dst-address=公网ip protocol=tcp dst-port=22023 action=dst-nat \
to-addresses=内网ip to-ports=22
/ip firewall nat add chain=srcnat \
dst-address=内网ip protocol=tcp dst-port=22 action=masquerade