NAT feom WAN to localserver over GRE tunnel

Pls help how to nat .
web server tcp/80 in local network. office mikrotik connected to CHR in cloud over GRE tunnel . how to nat from external IP of cloud CHR mikrotik to local server behind office mikrotik.
if you can. pls variant with saving source address internet users. for correct working file2ban on webserver




https://drive.google.com/file/d/1-GZlPW-FLayTFsjYZr8BJre49UE3_9fI/view?usp=sharing
nat WEBSERVER over gre tunnel.jpg