How does VPN routing work?

Question

Computer networks

Good afternoon. We use equipment that has only the server IP, port, APN from the settings. Server part under Windows. Established software tools do not know how to do anything related to routing and VPN. At the moment, everything is simple - we work on the open Internet, static on the server, dynamics on the equipment, binding to the transmitted number. But there are reasons to switch to a VPN network.
At the mobile operator in other directions, we use a VPN network with a separate APN. A purely local network like 10.10.0.0 without any routing anywhere.
In the application form for modifying our APN or creating a new one, there is an item "Availability of Internet access -> Restricted access (list of IP addresses)". I would like to lay the existing IP.
I roughly understand how this will work when sending from a VPN network to a white IP, there are no difficulties here. But in the opposite situation, if we have to get from the white IP to the VPN network, I’m a little not sure. I assume that in this case, the operator must provide some gateway for accessing our VPN network, and I must configure the routing myself, they say, if you need to get to 10.10.0.1, then contact the operator's gateway. Please clarify what are the nuances in this moment.
The global task is the following. We work on the open Internet, 80% of SIM-cards of one operator. The task is to work in a VPN, use a white IP as a backup and for those 20% of non-main mobile operators. For these purposes, we have a 3G router. Under 20% of the equipment, funds for iron will not be allocated.

Answer 1

Your description is somewhat chaotic (it would be better to attach a diagram). If I understand correctly:
The operator can make an incoming translation rule on his gateway and traffic from the Internet to you in the vpn subnet will come via l2, here he doesn’t even need to write any routes, if feedback or a two-way connection is required, then it’s already more difficult, you from your gray vpn subnet needs at least a default gateway for each device.

Answer 2

I support cssman, you need TK and preferably with the current and required karinka of the seme. Everything is very vague, or rather confusing.