Ahh yes, a little memory jog helps.
However, there is one thing you dont realize. You have a dynamic public IP, and thats why any dyndns provider works to keep your wan updated. Your own IP cloud on the router will do the same thing.
In other words there is already a free dyndns service that comes with MT. However if there service goes down as it does from time to time good to have a backup.
All to say using BTH is not necessary and clunky.
Be that as it may will focus on your issues.
The backdoor approach for ether8 is simple.
set [ find default-name=ether8 ] l2mtu=9216 mtu=9216 name=OffBridge8
add address=192.168.80.1/30 interface=OffBridge8 network=192.168.80.0
add interface=OffBridge8 list=LAN
Done, plug laptop into router on ether8, change IPV4 settings on the laptop to 192.168.80.2 and via username and password (winbox) you should be in.
Create a vlan200 for proton,
/ip dchp server-network
add address=192.168.200.0 dns-server=ProtonSuppliedDNS address gateway=192.168.200.254
If none supplied by proton then
/ip dchp server-network
add address=192.168.200.0 dns-server=10.2.0.1 address gateway=192.168.200.254
we reinforce that by the following dstnat rules
add chain=dstnat action=dst-nat in-interface=vlan200 dst-port=53 protocol=udp \
to-address=(either proton supplied DNS, or 10.2.0.1)
add chain=dstnat action=dst-nat in-interface=vlan200 dst-port=53 protocol=tcp \
to-address=(either proton supplied DNS, or 10.2.0.1)
Need a table
add fib name=useProton
Need a route
add dst-address=0.0.0.0/0 gateway=ProtonVPN routing-table=useProton
Need two routing rules in specific order
/routing rules
add min-prefix=0 action=lookup-only-in-table table=main
add action=lookup-only-in-table dst-address=0.0.0.0/0 in-interface=vlan200 table=useProton
Now depending upon DNS, if the Proton supplied DNS address is within the network already provided (10.2.0.0/24) or no DNS was supplied and thus using 10.2.0.1, no further routes are needed,
However if they gave you a different IP address for dns, lets say 10.20.3.1 (anything outside the wg network) then you would need to add a route
add dst-address=10.20.3.1 gateway=ProtonVPN routing-table=main
See how far that gets you...