Mikrotik路由器TCP/80端口DST-NAT规则失效，其他端口正常的问题求助

大家好，我最近碰到个头疼的问题：我尝试把Mikrotik路由器公网IP接口上的TCP/80端口入站流量，通过反向代理转发到内网服务器上，但不管怎么调整配置，针对TCP/80端口的DST-NAT规则就是不生效。可要是把目标端口换成TCP/8080或者其他任意端口，规则立马就能正常工作。

更奇怪的是，用TCP/80作为目标端口时，数据包似乎能到达目标机器，但返回的数据包却没办法回到公网这边。

下面是我的/ip firewall filter配置输出：

Flags: X - disabled, I - invalid, D - dynamic

0  D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough

1 X  ;;; vacuum-logging
chain=forward action=log src-address=192.168.1.32 log=yes log-prefix="VACUUM"

2    ;;; Allow OpenVPN
chain=input action=accept protocol=tcp dst-port=1194

3    ;;; Allow HTTP
chain=input action=accept protocol=tcp in-interface=pppoe-out1 dst-port=80 log=yes log-prefix="IN_HTTP_ALLOW"

4    ;;; defconf: accept established,related,untracked
chain=input action=accept connection-state=established,related,untracked

5    ;;; defconf: drop invalid
chain=input action=drop connection-state=invalid

6    ;;; defconf: accept ICMP
chain=input action=accept protocol=icmp

7    ;;; defconf: accept to local loopback (for CAPsMAN)
chain=input action=accept dst-address=127.0.0.1

8    ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface=pppoe-out1 log=no log-prefix="DROP"

9    ;;; defconf: accept in ipsec policy
chain=forward action=accept ipsec-policy=in,ipsec

10    ;;; defconf: accept out ipsec policy
chain=forward action=accept ipsec-policy=out,ipsec

11    ;;; defconf: fasttrack
chain=forward action=fasttrack-connection connection-state=established,related

12    ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked

13    ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid

14    ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN

还有/ip firewall nat配置输出：

Flags: X - disabled, I - invalid, D - dynamic

0    ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN ipsec-policy=out,none

1    chain=dstnat action=dst-nat to-addresses=192.168.1.110 to-ports=8080 protocol=tcp in-interface=pppoe-out1 dst-port=80 log=yes log-prefix="NAT_HTTP"

备注：内容来源于stack exchange，提问作者Jiri Kara