Mikrotik and Kerio IPSEC via PPTP?

Question

Mikrotik

Good afternoon!
I can not make friends with Kerio Control and Mikrotik. I took the setup instructions here https://habrahabr.ru/post/216215/
Mikrotik is configured on an interesting provider. From it, data for the WAN and PPTP connection settings for the Internet are given. The white address 1.1.1.1 is selected
The connection itself is established:
- In Kerio it says that "Connection to 1.1.1.1 is established".
- In Mikrotik:
/ip ipsec peer> print
Flags: X - disabled, D - dynamic
0 address=2.2.2.2/32 local-address=0.0.0.0 passive=yes port=500
auth-method=pre-shared- key secret="secret"
generate-policy=port-override policy-template-group=default
exchange-mode=main-l2tp send-initial-contact=yes nat-traversal=no
hash-algorithm=sha1 enc-algorithm=3des dh-group=modp1536 lifetime=1d
dpd-interval=2m dpd-maximum-failures=5
/ ip ipsec policy> print
2 D src-address=192.168.5.0/24 src-port=any dst-address=192.168.0.0/24 dst-port=any protocol=all action=encrypt
level=require ipsec-protocols=esp tunnel =yes sa-src-address=1.1.1.1 sa-dst-address=2.2.2.2 priority=2
/ip firewall nat> print
0 chain=srcnat action=accept src-address=192.168.5.0/24 dst-address=192.168 .0.0/24 log=no log-prefix=""
2 chain=srcnat action=masquerade out-interface=pptp-out1 log=no log-prefix=""
/tool> traceroute
address: 192.168.0.1
# ADDRESS LOSS SENT LAST AVG BEST WORST STD-DEV STATUS
1 172.16.100.51 0% 7 1.2ms 1.2 1.1 1.5 0.1
2 188.124.228.1 0% 7 2.8ms 10.8 1.9 39.9 14.2
3 198.224.22 4.1 0.8 host unreachable from 188.124.228.1
What kind of IP-addresses are not clear during tracing...
Good people, how to be, what to do? How to merge networks behind Mikrotik and Kerio?
UPD1:
Pings and tracerout also don't work with Kerio

Answer 1

Everything turned out to be too easy. Kerio and Mikrotik cannot communicate if Mikrotik has more than one network in Policies. After I removed the checkbox in Local Networks "Use automatically determined local networks" in Kerio and left only the necessary one network in "Custom Networks", then everything worked.

Answer 2

1) in nat also add a writeback
chain=srcnat action=accept src-address=192.168.0.0/24 dst-address=192.168.5.0/24 log=no log-prefix=""
you must be from network 192.168.5.0/24