Site to site l2tp and port forwarding FTP

Hello Guys

I have a problem with port forwarding beetwen 2 mikrotik routers.

Router1 (MAIN) - router with public IP address, i got on it some dst-nat for few services (like ftp on synology)
local LAN 192.168.102.1/24
WAN speed 60/10

Router2 (SECOND) - router connected to other router, on WAN interface its normal local address (192.168.0.27/24)
route 0.0.0.0/0 → 192.168.0.1 → internet work OK, i Wanted people who manage this router before my MT to forward for me some ports, he says he did but it didnt work, but its not the case.
local LAN 192.168.0.0/24
WAN speed 60/10

I thought about workaround and i setup a VPN L2TP on my MAIN MT, i tested it on computer and everything was ok, i got access to printers and local addresses. So i created a VPN client on SECOND MT,i added new profile and gave addresses: MAIN l2tp address: 192.168.104.1
SECOND l2tp address: 192.168.104.2. Everything connect great

i created routes:

on MAIN:
192.168.0.0/24 → 192.168.104.2
on SECOND:
192.168.102.0/24 → 192.168.104.1

and on routers everything seems to work correct, i can normally ping addresses from MAIN to SECOND and viceversa, so i wanted to create port forwarding from my MAIN public IP example.
my public IP on main is 1.1.1.1:
on firewall:
MAIN dst-nat dst-addres: 1.1.1.1 protocol tcp, port 9002 → dst-nat to 192.168.0.99 ,port 21(my ftp serwer behind SECOND)

and heres a problem,

i was trying very much things, i created src-nat on SECOND from 192.168.0.99 → 89.71.0.108, added route to 89.71.0.108 with vpn gateway → nothing happedned

changed rules on MAIN
dst-nat from 0.99 to 192.168.104.2, then on SECOND added another dst-nat to 0.99 and src-nat from 0.99 to 192.168.104.1(MAIN) → nothing works

done a lot of other things, changing dst-addresess, etc. i tried everything, get trough tons of google and can’t find solution.

Maybe i’m doing smth wrong ?

I even changed on SECOND default route 0.0.0.0/0 gateway to vpn, and then it worked, but i don’t want to get all the traffic trough vpn because i’m not using my full internet speed (from 60 mb to around 10, max up rate). Can anyone help me with this ? maybe i’m getting smth wrong ?

You could have picked better protocol to play with. :slight_smile:

Try to check this thread, if you find some inspiration there. That one is about dual WAN config, but it’s basically the same problem from FTP’s perspective.