Automatic upgrade should be the default and is quickly becoming best practice.

I also want this feature.

I have the IPSec tunnel working well. I'm not sure how to have the 80,443 traffic route out of the GW 1.1.2.1 though.

I don't understand in the diagram how traffic is going out of GW 1.1.2.1

The purpose is to have all my home web traffic exit the VPS Mikrotik. I think it is essentially pretty close to this: https://wiki.mikrotik.com/wiki/Routing_through_remote_network_over_IPsec So using that diagram, my intent is to route 80,443 from workstations on 10.10.10.0/24 out the other GW of 1....