VPN with printing issues

Hello everyone ,
I’m a newbie but have been using mikrotiks for about 6 months . I have 2x rb750 and this is the scenario:

I Have a VPN to Access to main network from a branch to the main offices. The internet connection is 3g in a dlink 2750u router. The DHCP range at the branch is 192.168.39.96 - 192.168.39.127.

i have made the VPN with pptp server to Access the network at the branch from the main offices as i have to print to the branch printer from a RDP session to a pc at the main offices.

Ok, I configured ether1 address to 192.168.1.2 and the dlink router as the gate way which is 192.168.1.1 I created a lan pool of 192.168.39.96/27 and bridged the reaming ports together this is the Branch network.

I have configured the VPN with 172.16.200.0/24 and it Works. I can Access remotely to to both branch and main offices and can ping the printer from the main office to the branch on ip 192.168.39.100 and get a reply i can add the printer with success but however cannot print.

i have added the below rules in hope this would sort the issues i get traffic on the rules but the printing still fails and port 9100 remains closed when i view the connections

/ip firewall filter
add chain=forward connection-nat-state=dstnat connection-state=invalid,established,related in-interface=ether1 log=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat comment=“Brother 2700” dst-port=9100 out-interface=BR-LAN protocol=tcp
add action=masquerade chain=srcnat comment=“masquerade . vpn traffic” src-address=172.16.200.0./24
add action=dst-nat chain=dstnat comment=“Brother 2700” dst-port=9100 protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.39.100

I think that i am missing a rule or set one up on the firewall incorrectly ?

please help
Thank you.

In general the easiest way to attach a VPN outpost to an existing LAN that is not prepared for routing, is
to use addresses from the LAN space and use proxy-arp to connect the LAN side router to it.

The devices will get addresses inside the LAN space and everything just connects without having to fiddle
with NAT, port forwarding, etc.

When your LAN is already routed and a route can be configured inside the existing default gateway, you
can add a new subnet for your VPN users and just route it. Also no NAT required and no problems like
the one described here.

So it is probably best to go back to the design board.