The desription I gave doesn’t depend on what particular kind of WAN connection you use at home. In your particular setup, the primary WAN seems to have a public IP, so you may want that the Dynamic DNS was only updated with the public IP of the LTE path, which makes sense if the primary WAN connection flaps between up and down for extended periods of time, so the VPN would keep re-establishing all the time. This can be achieved by means of mangle rules on the Mikrotik, making it access the Mikrotik’s cloud servers via the LTE WAN. Only one fqdn per serial number is available at Mikrotik cloud; other dynamic DNS providers have different options.
Other than that, both peers need to be Mikrotiks or other routers with similar depth of configuration available to the administrator (such as OpenWRT-based devices); there is no way how an embedded VPN client in a mobile client or a laptop computer for non-IT user could be used directly. On Windows, you can activate Hyper-V and run a virtual Mikrotik; I carry around a mAP as it is the smallest footprint device with two Ethernet connectors and a wide choice of powering options from a barrel jack through USB to both passive and standard PoE. There is also the mAP lite which is even smaller, but for my purposes the single Ethernet port is too limiting.
Regarding IPsec - yes, whatever is flexible is inevitably complex to set up, and whatever is complex to set up is scary at first sight. But in order that the principle of “beating the NAT” worked, you need that both peers actively initiate the connection, because both must open the pinholes in the NAT(s) at their end from the private side of the NAT. And to date, this is only possible with IPsec and Wireguard, and Wireguard is only available in RouterOS 7 which is still beta at the time of writing this. On the other hand, so far Wireguard supports only a single application mode - a site to site tunnel, hence it is extremely simple to set up. Its another advantage is that it can accommodate to the change of the public IP and port of one of the peers at a time with a loss of just a few packets; its disadvantage is that the current Mikrotik implementation doesn’t support configuration using fqdn so you’d have to use some scripting to overcome this.
The good news for you is that you can implement all that step by step on your table, first the plain IPsec connection using the LAN of your home router using IP numbers as peers’ address items; once you grasp that, you can add the port translation rules, and if it still works (you have to disable the peers at both devices after adding these rules for more than 3 minutes so that the pinholes in Mikrotik’s own firewall could expire), you can try the full setup with DNS names using your mobile phone’s connection sharing for the mAP (so that you would get to the home router via WAN).
This application example should be clear enough; just change the exchange-mode to ike2, you can stick with auth-method=pre-shared-key. If you use the default profiles and proposals at both machines, you will not drown in those flexibility settings.
If you get stuck, you can always post the existing configurations of both machines for a review here.
