SIP за точкой доступа

MT1 | FC2 |

Настройка моей сети. Телефонный аппарат SIP не работал за MT2, но работал за MT1. За MT1 у меня настроено NAT с источником и много правил брандмауэра, а за MT2 - только правила брандмауэра для точки доступа и правила защиты от вирусов, которые я скопировал из демонстрационного роутера Mikrotik. Не понимаю, чего не хватает? Ниже приведена выгрузка из брандмауэра:

`/ ip firewall set input name="input" policy=accept comment=""`
`set forward name="forward" policy=accept comment=""`
`set output name="output" policy=accept comment=""`
`add name="virus" policy=none comment=""`
`add name="hotspot-temp" policy=none comment="limit unauthorized hotspot clients"`
`add name="hotspot" policy=none comment="account authorized hotspot clients"`

`/ ip firewall rule forward add in-interface=hotspot1 action=jump jump-target=hotspot-temp comment="limit access for unauthorized hotspot clients" disabled=no`
`add action=jump jump-target=hotspot comment="account traffic for authorized hotspot clients" disabled=no`
`add action=jump jump-target=virus log=yes comment="jump 2 virus" disabled=no`

`/ ip firewall rule hotspot`
`/ ip firewall rule hotspot-temp add flow=hs-auth action=return comment="return, if connection is authorized" disabled=no`
`add protocol=icmp action=return comment="allow ping requests" disabled=no`
`add dst-address=:53 protocol=udp action=return comment="allow dns requests" disabled=no`
`add action=reject comment="reject access for unauthorized hotspot clients" disabled=no`

`/ ip firewall rule input add in-interface=hotspot1 dst-address=:80 protocol=tcp action=jump jump-target=hotspot comment="account traffic from hotspot clients to hotspot servlet" disabled=no`
`add in-interface=hotspot1 dst-address=:80 protocol=tcp action=accept comment="accept requests for hotspot servlet" disabled=no`
`add in-interface=hotspot1 dst-address=:67 protocol=udp action=accept comment="accept requests for local DHCP server" disabled=no`
`add in-interface=hotspot1 action=jump jump-target=hotspot-temp comment="limit access for unauthorized hotspot clients" disabled=no`
`add dst-address=:53 protocol=udp action=accept comment="" disabled=no`
`add action=jump jump-target=virus comment="jump2 virus" disabled=no`

`/ ip firewall rule output add src-address=:80 out-interface=hotspot1 protocol=tcp action=jump jump-target=hotspot comment="account traffic from hotspot servlet to hotspot clients" disabled=yes`

`/ ip firewall rule virus add dst-address=:135-139 protocol=tcp action=drop comment="Drop Blaster Worm" disabled=no`
`add dst-address=:135-139 protocol=udp action=drop comment="Drop Messenger Worm" disabled=no`
`add dst-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" disabled=no`
`add dst-address=:445 protocol=udp action=drop comment="Drop Blaster Worm" disabled=no`
`add dst-address=:593 protocol=tcp action=drop comment="" disabled=no`
`add dst-address=:1024-1030 protocol=tcp action=drop comment="" disabled=no`
`add dst-address=:1080 protocol=tcp action=drop comment="Drop MyDoom" disabled=no`
`add dst-address=:1214 protocol=tcp action=drop comment="________" disabled=no`
`add dst-address=:1363 protocol=tcp action=drop comment="ndm requester" disabled=no`
`add dst-address=:1364 protocol=tcp action=drop comment="ndm server" disabled=no`
`add dst-address=:1368 protocol=tcp action=drop comment="screen cast" disabled=no`
`add dst-address=:1373 protocol=tcp action=drop comment="hromgrafx" disabled=no`
`add dst-address=:1377 protocol=tcp action=drop comment="cichlid" disabled=no`
`add dst-address=:1433-1434 protocol=tcp action=drop comment="Worm" disabled=no`
`add dst-address=:2745 protocol=tcp action=drop comment="Bagle Virus" disabled=no`
`add dst-address=:2283 protocol=tcp action=drop comment="Drop Dumaru.Y" disabled=no`
`add dst-address=:2535 protocol=tcp action=drop comment="Drop Beagle" disabled=no`
`add dst-address=:2745 protocol=tcp action=drop comment="Drop Beagle.C-K" disabled=no`
`add dst-address=:3127 protocol=tcp action=drop comment="Drop MyDoom" disabled=no`
`add dst-address=:3410 protocol=tcp action=drop comment="Drop Backdoor OptixPro" disabled=no`
`add dst-address=:4444 protocol=tcp action=drop comment="Worm" disabled=no`
`add dst-address=:4444 protocol=udp action=drop comment="Worm" disabled=no`
`add dst-address=:5554 protocol=tcp action=drop comment="Drop Sasser" disabled=no`
`add dst-address=:8866 protocol=tcp action=drop comment="Drop Beagle.B" disabled=no`
`add dst-address=:9898 protocol=tcp action=drop comment="Drop Dabber.A-B" disabled=no`
`add dst-address=:10000 protocol=tcp action=drop comment="Drop Dumaru.Y" disabled=no`
`add dst-address=:10080 protocol=tcp action=drop comment="Drop MyDoom.B" disabled=no`
`add dst-address=:12345 protocol=tcp action=drop comment="Drop NetBus" disabled=no`
`add dst-address=:17300 protocol=tcp action=drop comment="Drop Kuang2" disabled=no`
`add dst-address=:27374 protocol=tcp action=drop comment="Drop SubSeven" disabled=no`
`add dst-address=:65506 protocol=tcp action=drop comment="Drop PhatBot, Agobot, Gaobot" disabled=no`
`add dst-address=:5555 protocol=tcp action=drop comment="" disabled=no`
`add src-address=:445 protocol=tcp action=drop comment="Drop Blaster Worm" disabled=yes`
`add src-address=:135-139 protocol=udp action=drop comment="Drop Messenger Worm" disabled=yes`
`add src-address=:445 protocol=udp action=drop comment="Drop Blaster Worm" disabled=yes`
`add src-address=:135-139 protocol=tcp action=drop comment="Drop Messenger Worm" disabled=yes`

`/ ip firewall service-port set ftp ports=21 disabled=no`
`set pptp disabled=yes`
`set gre disabled=yes`
`set h323 disabled=yes`
`set mms disabled=no`
`set irc ports=6667 disabled=no`
`set quake3 disabled=no`
`set tftp ports=69 disabled=no`

`/ ip firewall mangle add in-interface=internet action=passthrough mark-flow=internet_packet comment="" disabled=yes`
`add in-interface=hotspot1 action=passthrough mark-flow=local_packet comment="" disabled=yes`

`/ ip firewall connection tracking set enabled=yes`
`tcp-syn-sent-timeout=2m`
`tcp-syn-received-timeout=1m`
`tcp-established-timeout=5d`
`tcp-fin-wait-timeout=2m`
`tcp-close-wait-timeout=1m`
`tcp-last-ack-timeout=30s`
`tcp-time-wait-timeout=2m`
`tcp-close-timeout=10s`
`udp-timeout=30s`
`udp-stream-timeout=3m`
`icmp-timeout=30s`
`generic-timeout=10m`

Я использовал SIP через NAT MT роутер успешно, но не через хотспот. Хотспот просто аутентифицирует или ещё выполняет какие-то функции файрволла и т.д.?