How to raise a VPN server on mikrotik behind NAT? Or from an external network go to a hilink modem with a static address?

Question

VPN

Good day! There is a mikrotik that accesses the Internet via a 4g Huawei E3372 modem with custom firmware, operating in hilink mode. Those. The router is behind the NAT of the modem. Only 1 port is forwarded on the modem to access the microt via WInbox. The modem's web interface can only be accessed from the internal network. No equipment is connected to the router, on which something like Teamviewer could be installed.
The ultimate goal: to set up vpn on the router.
Options:
1. Does Winbox have a browser? To go through it to the modem and configure port forwarding.
2. Raise your VPN and make mikrotik its client. I got confused by this option, but it seems that the connection cuts the modem's NAT.
3. Connect via telnet from mikrotik to modem and tweak iptables. It turned out to connect, but no changes are made to iptables. Perhaps there are some features of the modem?
The whole thing is complicated by the fact that the equipment is not only 150 km away from me, but also on the territory of a closed city, where it will not be possible to quickly get there.
I will consider any options. I will provide additional information. Thank you in advance.

Answer 1

If you have access to Mikrotik, connect it to your vpn.
Next, by port forwarding, go to the modem through the vpn network. I think the easiest

Answer 2

2. Raise your VPN and make mikrotik its client. I got confused by this option, but it seems that the connection cuts the modem's NAT.

Use ports/protocols for the VPN connection that will not be cut by the NAT (or is it still a firewall?) of the modem.