Right, so in the end what worked was the change-mss mangle rule suggested in this post: http://forum.mikrotik.com/t/nordvpn-ipsec-ikev2-killswitch-for-ros6/144817/24
Now it all works, which is great. I get the Nord server public ip address from all my LAN machines. Sadly, i’m still getting geo-blocked by some of the services that I’d hoped to use. This is frustrating because using the native nordvpn client to setup a tunnel on an individual machine works fine with these services. Ah. I do appear to have a DNS leak. I have google DNS servers showing up 
Thanks for all the help so far!