AWS CHR as L2TP IPSec VPN site-to-site not working

Hello,
my goal is to adopt TP-Link AP from site B to its controller on site A
we have Mikrotik CAP shortage in our country then I use TP-Link
here is the topology




  • I can ping everything


  • I can see AP from OC200 controller


  • but my problem is I can’t adopt AP to Controller


  • and I can’t access AP via web browser

Both site only have Private IP from ISP so I use free tier AWS and CHR with elastic IP
yes so far this is my best solution for VPN without Public IP
When I ping google (without VPN) on each site I believe first 2 hop is Private IP

is it port forwarding problem?