- If the application doesn’t care about original source addresses, simple fix is:
/ip firewall nat
add chain=srcnat dst-address=192.168.100.254 protocol=tcp dst-port=29000 action=masquerade
Now the problem is that dstnat works, but if client is e.g. 1.2.3.4 connecting to 41.xx.xx.xx, server sees source 1.2.3.4, so it tries to respons to it directly using its main connection, but it doesn’t work, because client expects response from 41.xx.xx.xx. With this rule, application will see 192.168.100.1 as source, will send response back to VPN server, and connetion tracking will take care of the rest.
If the application does need to see original source addresses, this router can’t help you, it would have to be handled on VPServer.
- VPN server is this router and 41.xx.xx.xx is its own address, right? It won’t work with RouterOS v6, unless you’d use really ugly config (in fact, even worse when it’s local address). But do you really need router itself connecting to the application?
Edit: Scratch 2), I misread it. If it’s from VPServer, then 1) fixes that too.