use in-physical interface leading to the modem
modem = 192.168.1.1 (DMZ to 192.168.1.2)
ether1(modem) = 192.168.1.2
local webserver = 10.0.0.1/24
example DMZ
#port forwarding to local ssh /ip firewall nat add chain=dstnat in-interface=ether1 dst-address=192.168.1.2 protocol=tcp dst-port=22 action=dst-nat to-address=10.0.0.1 to-port=22