Dear experts,
Hope you will be fine.
I have CHR as my VPN server and my home Mikrotik is a client VPN. I have port forward on my home Mikrotik my VM it's easily accessible. But when I routed the VM to the L2TP-VPN. Port forwarding is not working.


/interface bridge
add name=Bridge_LAN port-cost-mode=short
add name="Bridge_LAN C-Park" port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] name=ether1_WAN
/interface l2tp-client
add connect-to=xx.xx.xx.xx name=l2tp-out1 use-ipsec=yes user=ppp1
/interface pppoe-client
add disabled=no interface=ether1_WAN name=PPPoE user=ABCXYZ
/ip pool
add name=dhcp_pool ranges=192.168.110.100-192.168.110.200
add name=VPN-pool ranges=192.168.84.2-192.168.84.10
/ip dhcp-server
add address-pool=dhcp_pool interface=Bridge_LAN name=dhcp1
/ppp profile
add dns-server=8.8.8.8,1.1.1.1 local-address=192.168.84.1 name=sstp-profile \
remote-address=VPN-pool
/routing table
add disabled=no fib name=to_L2TP
/interface bridge port
add bridge="Bridge_LAN C-Park" interface=ether2 internal-path-cost=10 \
path-cost=10
add bridge=Bridge_LAN interface=ether3 internal-path-cost=10 path-cost=10
add bridge=Bridge_LAN interface=ether4 internal-path-cost=10 path-cost=10
add bridge=Bridge_LAN interface=ether5 internal-path-cost=10 path-cost=10
/interface l2tp-server server
set enabled=yes one-session-per-host=yes use-ipsec=yes
/ip address
add address=192.168.110.1/24 interface=Bridge_LAN network=192.168.110.0
add address=192.168.181.1/24 interface=wireguard1 network=192.168.181.0
/ip cloud
set ddns-enabled=yes ddns-update-interval=1m
/ip dhcp-server alert
add disabled=no interface=Bridge_LAN valid-server=18:FD:74:B3:A2:50
/ip dhcp-server lease
add address=192.168.110.101 always-broadcast=yes comment="Windows 10 Laptop" \
mac-address=74:70:FD:1D:CE:23
add address=192.168.110.102 always-broadcast=yes comment="Windows 11 Laptop" \
mac-address=74:E5:F9:D1:59:F2
add address=192.168.110.103 always-broadcast=yes mac-address=\
00:0C:29:CC:84:1B
/ip dhcp-server network
add address=192.168.110.0/24 dns-server=192.168.110.1,8.8.8.8,8.8.4.4 \
gateway=192.168.110.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.110.3 name=air.tegris.com
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=to_L2TP \
passthrough=yes src-address=192.168.110.103
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.110.0/24
add action=dst-nat chain=dstnat comment="Windows VM" dst-address=\
xx.xx.xx.xx dst-port=4480 protocol=tcp to-addresses=192.168.110.103 \
to-ports=3389
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=PPPoE routing-table=main \
suppress-hw-offload=no
add check-gateway=ping disabled=no distance=1 dst-address=192.168.94.0/24 \
gateway=192.88.16.2%*F00024 pref-src="" routing-table=main scope=30 \
suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=192.168.94.0/24 gateway=\
192.88.16.3%*F0002D routing-table=main scope=10 suppress-hw-offload=no
add disabled=no dst-address=0.0.0.0/0 gateway=l2tp-out1 routing-table=to_L2TP \
suppress-hw-offload=no