Mikrotik port forwarding through L2tp how to do it right?

Question

Mikrotik

Mikrotik 1 - white IP. It has an L2tp server.
Mikrotik 2 - gray IP, it is the l2tp Client of the 1st Mikrotika. In his local video recorder, and Ip cameras.
An EOIP tunnel is also up between M1 and M2.
From the local network Mikrotik 1 there is access to the local network Mikrotik 2 and vice versa Winbox sees both routers from any local area, SADPTool and ConfigTool see all cameras and the recorder.

Task - Using White IP mikrotik 1 to get to the registrar behind mikrotik 2.
Added rules to NAT
chain=srcnat out-interface=all-ppp add action=masquerade
add action=dst-nat chain=dstnat dst-port=37777 in-interface- list=WAN log=yes protocol=tcp to-addresses=192.168.88.200 to-ports=37777
I can't connect to the registrar from the Internet. in log -dstnat: in:ether1 out:(unknown 0), src-mac 00:04:96:cf:0e:a6, proto TCP (SYN), 46.133.148.103:38851->WHITE IP:37777 len 60
Not I can figure out what the problem is.
Help me please!

Answer 1

I understand that 192.168.88.200 is the address of the registrar on Mikrotik2?
Then you get the following...
Your request comes to the address of the registrar, but the response from the registrar goes along the default route, which is registered on Mikrotik2!!! Those. package is invalid!!!
I would do the following:
- on Mikrotik2 I marked the packets that leave the registrar
- I added a route to Mikrotik2: to 0.0.0.0/0 via vpn (to Mikrotik1) ONLY for the packages marked above
Well, probably something like this ...

Answer 2

mikrotik-ukraine.blogspot.com/2016/11/vpn-mikrotik.html

Answer 3

As per the link, it doesn’t work, I tried it, and the comments also say that it’s not a working scheme.

Answer 4

Add rules to Mikrotik1

/ip firewall nat
add action=masquerade chain=srcnat dst-address=192.168.88.200 dst-port=37777 protocol=tcp
add action=dst-nat chain=dstnat dst-port=37777 in-interface-list=WAN protocol=tcp to-addresses=192.168.88.200 to-ports=37777