OpenVPN is painful as the Mikrotik implementation only supports TCP transport which is good on stable networks but can cause issues if packet loss happens between client and server, because packet loss in TCP over TCP scenario causes retransmission on both.
On Mikrotik, you can configure the remote UDP port for the initial connection setup (default 500) but not for the NAT traversal mode (default 4500). So the solution for the desperate ones is to dst-nat outgoing traffic, which requires to set up an IP-IP tunnel from the Mikrotik to itself on local addresses and set a route to the VPS via one end of the tunnel, and route packets received at the other end of the tunnel via WAN after dst-nat’ing them to the ports X and Y you can use instead of 500 and 4500. And use iptables to do the reverse at the Linux end where you redirect packets coming to ports X and Y back to 500 and 4500.
If the Mikrotik is behind a NAT, IPsec will find that out and instead of using plain ESP (IP protocol 50), it will encapsulate ESP into UDP on port 4500. If Mikrotik has a public IP on itself, you have to link the peer to a private address and set up a src-nat to the public one; this will cause the IPsec to behave the same as if there was a NAT outside.
For inspiration, take the relevant part of this topic. But its purpose is only loosely related, so don’t blindly copy-paste everything from there.