/ip firewall nat
chain=dstnat add action=dst-nat dst-addresses=1.1.1.1 to-addresses=192.168.0.4

add action=drop chain=input comment="Drop invalid connections" \connection-state=invalid
add chain=input comment="VPN TEST" dst-port=1723 protocol=tcp
add chain=input comment="VPN TEST" protocol=gre
add chain=input comment=\"Allow access to the router from the LAN using adress list" \src-address-list=OurLocalLan
add chain=input comment="Allow established connections to the router" \connection-state=established
add chain=input comment="Allow related connections to the router" \connection-state=related
add chain=input comment="default configuration" protocol=icmp
add action=drop chain=input comment="Drop ftp brute forcers" dst-port=21 \protocol=tcp src-address-list=ftp_blacklist tcp-flags=""
add action=drop chain=input comment="drop ssh brute forcers" \connection-state=new dst-port=22 protocol=tcp src-address-list=\ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \address-list-timeout=1m chain=input connection-state=new dst-port=22 \protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \address-list-timeout=1m chain=input connection-state=new dst-port=22 \protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \address-list-timeout=1m chain=input connection-state=new dst-port=22 \protocol=tcp
add action=drop chain=input comment="Drop all other traffic to the router"
add action=drop chain=forward comment="Drop invalid connections" \connection-state=invalid
add action=drop chain=forward comment="default configuration" \connection-state=invalid disabled=yes
add chain=forward comment="Allow connections from the LAN" connection-state=\new in-interface=bridge-local
add chain=forward comment="Allow established connections" connection-state=\established
add chain=forward comment="Allow related connections" connection-state=\related
add action=drop chain=forward comment=\"Drop invalid connections for tcp connection" connection-state=invalid \protocol=tcp
add action=jump chain=forward jump-target=tcp protocol=tcp
add action=jump chain=forward jump-target=udp protocol=udp
add action=jump chain=forward jump-target=icmp protocol=icmp
add action=drop chain=forward comment="Block \"bogon\" IP addresses" \src-address=0.0.0.0/8
add action=drop chain=forward comment="Block \"bogon\" IP addresses" \st-address=0.0.0.0/8
add action=drop chain=forward comment="Block \"bogon\" IP addresses" \src-address=127.0.0.0/8
add action=drop chain=forward comment="Block \"bogon\" IP addresses" \dst-address=127.0.0.0/8
add action=drop chain=forward comment="Block \"bogon\" IP addresses" \src-address=224.0.0.0/3
add action=drop chain=forward comment="Block \"bogon\" IP addresses" \dst-address=224.0.0.0/3
add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22 \protocol=tcp src-address-list=ssh_blacklist
add chain=icmp comment="\"echo reply\"" icmp-options=0:0 protocol=icmp
add chain=icmp comment="\"net unreachable\"" icmp-options=3:0 protocol=icmp
add chain=icmp comment="\"host unreachable\"" icmp-options=3:1 protocol=icmp
add chain=icmp comment="\"host unreachable fragmentation required\"" \icmp-options=3:4 protocol=icmp
add chain=icmp comment="\"allow echo request\"" icmp-options=8:0 protocol=\icmp
add chain=icmp comment="\"allow time exceed\"" icmp-options=11:0 protocol=\icmp
add chain=icmp comment="\"allow parameter bad\"" icmp-options=12:0 protocol=\icmp
add chain=icmp comment="\"allow source quench\"" icmp-options=4:0 protocol=\icmp
add action=drop chain=icmp comment="\"deny all other types\"" icmp-options=0 \protocol=icmp
add action=drop chain=tcp comment="Deny TFTP" dst-port=69 protocol=tcp
add action=drop chain=tcp comment="Deny RPC portmapper" dst-port=111 \protocol=tcp
add action=drop chain=tcp comment="Deny RPC portmapper" dst-port=135 \protocol=tcp
add action=drop chain=tcp comment="Deny NBT" dst-port=137-139 protocol=tcp
add action=drop chain=tcp comment="Deny NetBus" dst-port=12345-12346 \protocol=tcp
add action=drop chain=tcp comment="Deny DHCP" dst-port=67-68 protocol=tcp
add action=drop chain=tcp comment="Deny BackOffice" dst-port=3133 protocol=\tcp
add action=drop chain=tcp comment="Deny NetBus" dst-port=20034 protocol=tcp
add action=drop chain=tcp comment="Deny CIFS" dst-port=445 protocol=tcp
add action=drop chain=tcp comment="Deny NFS" dst-port=2049 protocol=tcp
add chain=output content="\"530 Login incorrect\"" dst-limit=\1/1m,9,dst-address/1m protocol=tcp src-address-list=ftp_blacklist \tcp-flags=""
add action=add-dst-to-address-list address-list=ftp_blacklist \address-list-timeout=3h chain=output content="\"530 Login incorrect\""\protocol=tcp

add action=dst-nat chain=dstnat comment="Hairpin test 1" dst-address=\80.80.47.135 to-addresses=192.168.0.4 (this line is the troubling one)
add action=src-nat chain=srcnat comment="Hairpin test 2" dst-address=\192.168.0.4 to-addresses=80.80.47.135
add action=masquerade chain=srcnat comment="Hairpin test 3" dst-address=\192.168.0.0/24 src-address=192.168.0.0/24
add action=masquerade chain=srcnat comment="default configuration" \out-interface=bridge-local
add action=masquerade chain=srcnat out-interface=pppoe-out1