MIKROTIK -> VPN -> NETGEAR NAT ROUTER -> INTERNET -> VPN MIKROTIK

Dear Gentle Folk,

I wish to set up a central mikrotik vpn box with a static IP at our location, call it the concentrator because
it will handle multiple different incoming VPNs

Then I wish to add a remote client mikrotik to the inside lan of any standard random netgear/linksys/belkin or Time Warner router on the internet.

This client mikrotik will be assigned to its WAN side a random private IP by the
nat box which will nat the IP to whatever that nat boxes WAN IP is, which itself
may be a another private IP provided by the client’s ISP.

The client mikrotik behind the netgear will have a static private IP range assigned by me to its lan side.

This client mikrotik must then open a VPN connection to the public static IP of the mikrotik concentrator
box at our location, such that our server can connect to the client mikrotik using its unique static private IP range.

Can the client mikrotik open a VPN from behind a natted router to another mikrotik on a public IP?

This should work in concept. The only issue I can forsee is if the upstream client router (Time warner, netgear, etc) blocks the VPN connection. On some routers you have to explicitly allow VPN passthrough.

You could work around this with perhaps IPSec or SSTP (uses SSL).