I have two mikrotik routers. One router has real IP address assigned directly to the router (as usual). Another router don't have a real IP assigned to it's interface. Instead of that the real IP is assigned via DNAT by our ISP. Is it possible to establish an IPSec tunnel for this configuration? I've tried but had no luck.