Доступа к самому Mikrotik извне по ssh нет

Внутри сети подключаюсь к роутеру всё в порядке.

user@himik:~$ ssh -p 12345 -i ~/.ssh/id_rsa_mikro [email protected]
[abcdef@MikroG] > 

А из дома тишина :

alex@linux-5y4f:~> ssh -p 12345 -i ~/.ssh/id_rsa_mikro [email protected]

Роутер висит на выделенном адресе, ssh подключения на сервер внутри сети работает, а на сам роутер нет. Что-то нужно разрешить. Не знаю как.

/ip firewall nat

add action=src-nat chain=srcnat comment=Internet out-interface=bridge1WAN \
 to-addresses=195.18.18.18
add action=dst-nat chain=dstnat comment=\
 "80=HTML,443=HTMLS,58259=SSH trans to 1.2" dst-port=80,443,58259 \
 in-interface=bridge1WAN protocol=tcp to-addresses=192.168.1.2
add action=src-nat chain=srcnat comment="HTMLS Server answer to 1.1" \
 dst-address=192.168.1.2 dst-port=80,443,58259 protocol=tcp src-address=\
 !192.168.0.0/16 to-addresses=192.168.1.1
add action=dst-nat chain=dstnat comment="MySql to server second net" \
 dst-port=23801 in-interface=bridge1WAN protocol=tcp to-addresses=\
 192.168.1.2 to-ports=3306
add action=src-nat chain=srcnat dst-address=192.168.1.2 dst-port=3306 \
 protocol=tcp to-addresses=192.168.1.1
add action=dst-nat chain=dstnat comment=\
 "HTTPS From Local Net to Public IP -> masque to 1.2" dst-address=\
 195.18.18.18 dst-port=80,443 protocol=tcp src-address=192.168.0.0/16 \
 to-addresses=192.168.1.2
add action=src-nat chain=srcnat dst-address=192.168.1.2 dst-port=80,443 \
 protocol=tcp src-address=192.168.0.0/16 to-addresses=192.168.1.1
add action=dst-nat chain=dstnat comment="alex ssh" dst-port=14396 \
 in-interface=bridge1WAN protocol=tcp to-addresses=192.168.0.10
add action=masquerade chain=srcnat dst-address=192.168.1.0/24 src-address=\
 192.168.0.0/24
add action=masquerade chain=srcnat dst-address=192.168.0.0/24 src-address=\
 192.168.1.0/24
add action=dst-nat chain=dstnat comment="silent wifi ssh" dst-port=51491 \
 in-interface=bridge1WAN protocol=tcp to-addresses=192.168.0.8
add action=dst-nat chain=dstnat comment="tan wifi ssh" dst-port=11357 \
 in-interface=bridge1WAN protocol=tcp to-addresses=192.168.0.9
add action=dst-nat chain=dstnat comment="Mikrotik from internet outside" \
 dst-port=12345 in-interface=bridge1WAN protocol=tcp to-addresses=192.168.1.1

/ip firewall filter

add action=accept chain=input comment="Good connections" connection-state=established,related
add action=drop chain=input comment="Kill bad" connection-state=invalid
add action=accept chain=input comment="Ping me" protocol=icmp
add action=drop chain=input comment="Kill all inputs" in-interface-list=!LAN log=yes
add action=accept chain=forward comment="Good transit" \
  connection-state=established,related,untracked
add action=drop chain=forward comment="Bad transit" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN to LAN" \
  connection-nat-state=!dstnat connection-state=new in-interface=bridge1WAN
add action=accept chain=forward comment="to MySQL pass from WAN" \
  dst-port=3306 in-interface=bridge1WAN protocol=tcp
add action=accept chain=forward ipsec-policy=in,ipsec
add action=accept chain=forward ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward connection-state=established,related

/ip service

set www address=192.168.0.0/16,fe80::/64 port=18671
set ssh port=12345
set www-ssl address=192.168.0.0/16,fe80::/64 certificate=Webfig 
disabled=no port=16190