Not impressed that you made changes not knowing what you are doing.
Reset back to defaults on the firewall and ask from help from there.

Firewall is cripled beyond any usable protection simply because of first (top-most) rule allowing just any connection from WAN towards LAN.

I'm no expert but, I thought disabling those ports would turn them off completely.
Also, you have set disable=yes to several important firewall rules.

• Download winbox to your management PC
• connect management PC to router using one of ether2-ether5, run winbox and click MAC address of router to connect to it
• reset router with no defaults and reconnect by clicking MAC address
• create bridge and add ports ether1-ether4 to it
• set IP on bridge interface ... either run DHCP client or set static IP address. In the later case add default route and set IP address of a DNS server (these settings are only necessary to perform ROS upgrades. If you intend to upgrade it by uploading package files from management PC you can skip setting route and DNS)
• if you want router to sync time, configure (S)NTP client ... you might need default route and DNS settings if you're going to use some internet time server
• set IP address on ether5 interface (select IP address from server's subnet)
• add NAT rule:
  Code: Select all

  /ip firewall nat
  add action=dst-nat chain=dstnat dst-port=4088 in-interface=<bridge> to-addresses=<WEB server address>
  

• if web server doesn't use this router as default gateway, you'll have to add another NAT rule:
  Code: Select all

  /ip firewall nat
  add action=src-nat chain=srcnat in-interface=<bridge> dst-address=<WEB server address> to-addresses=<address of router in server's subnet>
  

Well, I missed the fact you're using the device inside LAN.

To achieve what you want it would best to configure device from scratch like this:

• Download winbox to your management PC
• connect management PC to router using one of ether2-ether5, run winbox and click MAC address of router to connect to it
• reset router with no defaults and reconnect by clicking MAC address
• create bridge and add ports ether1-ether4 to it
• set IP on bridge interface ... either run DHCP client or set static IP address. In the later case add default route and set IP address of a DNS server (these settings are only necessary to perform ROS upgrades. If you intend to upgrade it by uploading package files from management PC you can skip setting route and DNS)
• if you want router to sync time, configure (S)NTP client ... you might need default route and DNS settings if you're going to use some internet time server
• set IP address on ether5 interface (select IP address from server's subnet)
• add NAT rule:
  Code: Select all

  /ip firewall nat
  add action=dst-nat chain=dstnat dst-port=4088 in-interface=<bridge> to-addresses=<WEB server address>
  

• if web server doesn't use this router as default gateway, you'll have to add another NAT rule:
  Code: Select all

  /ip firewall nat
  add action=src-nat chain=srcnat in-interface=<bridge> dst-address=<WEB server address> to-addresses=<address of router in server's subnet>
  

There are additional tasks to be done if you want to restrict management access to router or if you want to restrict connections between both subnets.

Why NAT to the web server from Inside? You should be able to simply route to it.

Check firewall on the Computer ... some OSes (Windows most notably) consider anything but it's own subnet to be evil internet and block pings originating from other networks.

What is server's default gateway IP address? You can only route traffic from Sophos network via MT is either server or its default gateway know to use RB as gateway towards Sophos network.

What is server's default gateway IP address? You can only route traffic from Sophos network via MT is either server or its default gateway know to use RB as gateway towards Sophos network.

I want to route from Sophos network to Mk network.


Mikrotik bridge IP: 10.38.25.31
MIkrotik bridge GW: 10.38.10.1/16

Mikrotik ethernet 5 DHCP server: 192.168.214.1

Server IP: 192.168.214.20
GW:192.168.214.1

In the linked page, note the "routing subnet" between router1 and router2 ... it is important and makes life of both routers easier. The thing is that in usual SOHO networks router1 runs a stateful firewall as well ... and this firewall can trip if it doesn't see traffic in both directions. Which happens if router2 "WAN" address is directly part of router1 "LAN" subnet.
The other thing is (potential) firewall running on router2 ... so please post actual running config of mikrotik again (run /export file=anynameyouwish and copy-paste contents of that file).

# jan/01/2002 02:28:45 by RouterOS 6.47.9
# software id = LVL6-6NB9
#
# model = RB750Gr3
# serial number = CC210CD3A5AF
/interface list
add comment=192.168.214.x name=LAN2
add comment=10.38.x.x name=LAN1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/lora servers
add address=eu.mikrotik.thethings.industries down-port=1700 name=TTN-EU \
    up-port=1700
add address=us.mikrotik.thethings.industries down-port=1700 name=TTN-US \
    up-port=1700
/tool user-manager customer
set admin access=\
    own-routers,own-users,own-profiles,own-limits,config-payment-gw
/ip settings
set accept-redirects=yes accept-source-route=yes
/interface list member
add interface=ether1 list=LAN1
add interface=ether5 list=LAN2
/ip address
add address=10.38.25.31/16 interface=ether1 network=10.38.0.0
add address=192.168.214.1/24 interface=ether5 network=192.168.214.0
add address=10.38.25.31 interface=ether1 network=10.38.25.31
add address=192.168.214.1/24 interface=ether2 network=192.168.214.0
/ip dns
set servers=10.38.4.2
/ip route
add check-gateway=ping distance=1 dst-address=10.38.0.0/16 gateway=ether1
add distance=1 dst-address=10.38.10.1/32 gateway=ether1
/tool user-manager database
set db-path=flash/user-manager

In the linked page, note the "routing subnet" between router1 and router2 ... it is important and makes life of both routers easier. The thing is that in usual SOHO networks router1 runs a stateful firewall as well ... and this firewall can trip if it doesn't see traffic in both directions. Which happens if router2 "WAN" address is directly part of router1 "LAN" subnet.
The other thing is (potential) firewall running on router2 ... so please post actual running config of mikrotik again (run /export file=anynameyouwish and copy-paste contents of that file).

Code: Select all

# jan/01/2002 02:28:45 by RouterOS 6.47.9
# software id = LVL6-6NB9
#
# model = RB750Gr3
# serial number = CC210CD3A5AF
/interface list
add comment=192.168.214.x name=LAN2
add comment=10.38.x.x name=LAN1
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/lora servers
add address=eu.mikrotik.thethings.industries down-port=1700 name=TTN-EU \
    up-port=1700
add address=us.mikrotik.thethings.industries down-port=1700 name=TTN-US \
    up-port=1700
/tool user-manager customer
set admin access=\
    own-routers,own-users,own-profiles,own-limits,config-payment-gw
/ip settings
set accept-redirects=yes accept-source-route=yes
/interface list member
add interface=ether1 list=LAN1
add interface=ether5 list=LAN2
/ip address
add address=10.38.25.31/16 interface=ether1 network=10.38.0.0
add address=192.168.214.1/24 interface=ether5 network=192.168.214.0
add address=10.38.25.31 interface=ether1 network=10.38.25.31
add address=192.168.214.1/24 interface=ether2 network=192.168.214.0
/ip dns
set servers=10.38.4.2
/ip route
add check-gateway=ping distance=1 dst-address=10.38.0.0/16 gateway=ether1
add distance=1 dst-address=10.38.10.1/32 gateway=ether1
/tool user-manager database
set db-path=flash/user-manager

/ip address
add address=10.38.25.31/16 interface=ether1 network=10.38.0.0
add address=192.168.214.1/24 interface=ether5 network=192.168.214.0
# The following two lines should be removed
add address=10.38.25.31 interface=ether1 network=10.38.25.31
add address=192.168.214.1/24 interface=ether2 network=192.168.214.0

/ip route
# Routes are both wrong
add check-gateway=ping distance=1 dst-address=10.38.0.0/16 gateway=ether1
add distance=1 dst-address=10.38.10.1/32 gateway=ether1
# Use this one instead ... not needed for connections between both subnets but it is needed for subnet 192.168.214.0/24 to be able to reach network beyond sophos LAN
add gateway=10.38.10.1

• If you can configure sophos to use MT as gateway towards subnet 192.168.214.0/24 and configure its firewall not to track connections between both subnets, then no NAT on MT is necesary (well, this depends also on firewalls on end devices, they might trip on connections from the other subnet).
• If you can setup sophos with static route but you can't change firewall settings, then use of "routing subnet" between sophos and MT solves this problem, again no NAT needed.
• if you can't change any settings on sophos, then you'll need to do both src-nat and dst-nat on MT. If this is the case and you don't know what particular kind of NAT rules are needed, come back with good description of requirements. Beware that using NAT comes with constraints and limitations so you should avoid this type of solution if possible

There are a few errors in your configuration:

/ip address
add address=10.38.25.31/16 interface=ether1 network=10.38.0.0
add address=192.168.214.1/24 interface=ether5 network=192.168.214.0
# The following two lines should be removed
add address=10.38.25.31 interface=ether1 network=10.38.25.31
add address=192.168.214.1/24 interface=ether2 network=192.168.214.0

/ip route
# Routes are both wrong
add check-gateway=ping distance=1 dst-address=10.38.0.0/16 gateway=ether1
add distance=1 dst-address=10.38.10.1/32 gateway=ether1
# Use this one instead ... not needed for connections between both subnets but it is needed for subnet 192.168.214.0/24 to be able to reach network beyond sophos LAN
add gateway=10.38.10.1

The last error (routing) was probably not a show stopper for your particular problem.

Regarding your last change (adding NAT): it may or may not be necessary, but that entirely depends on settings of sophos router/firewall:

• If you can configure sophos to use MT as gateway towards subnet 192.168.214.0/24 and configure its firewall not to track connections between both subnets, then no NAT on MT is necesary (well, this depends also on firewalls on end devices, they might trip on connections from the other subnet).
• If you can setup sophos with static route but you can't change firewall settings, then use of "routing subnet" between sophos and MT solves this problem, again no NAT needed.
• if you can't change any settings on sophos, then you'll need to do both src-nat and dst-nat on MT. If this is the case and you don't know what particular kind of NAT rules are needed, come back with good description of requirements. Beware that using NAT comes with constraints and limitations so you should avoid this type of solution if possible