I have an iPhone with AT&T and have L2TP setup for VPN access to my Mikrotik. AT&T does not block VPN service.
Couple of Code snippets:
/Firewall
21 ;;; Permit L2TP VPN
chain=input action=accept protocol=udp in-interface=ether5 dst-port=500 log=no log-prefix=""
chain=input action=accept protocol=udp in-interface=ether5 dst-port=4500 log=no log-prefix=""
chain=input action=accept protocol=udp in-interface=ether5 dst-port=1701 log=no log-prefix=""
chain=input action=accept protocol=ipsec-esp in-interface=ether5 log=no log-prefix=""
/Pool used for VPN Clients
/ip pool> print
# NAME RANGES
3 l2tp_pool 192.168.100.5-192.168.100.20
/ppp> profile print
Flags: * - default
0 * name="default" use-mpls=default use-compression=default use-encryption=default only-one=default change-tcp-mss=yes
use-upnp=default address-list="" on-up="" on-down=""
1 * name="default-encryption" local-address=192.168.100.1 remote-address=l2tp_pool use-mpls=default
use-compression=default use-encryption=required only-one=default change-tcp-mss=yes use-upnp=no address-list=""
dns-server=192.168.100.1 on-up="" on-down=""
/ip ipsec> policy print
Flags: T - template, X - disabled, D - dynamic, I - inactive, * - default
0 T * group=default src-address=::/0 dst-address=::/0 protocol=all proposal=default template=yes
/ip ipsec> proposal print
Flags: X - disabled, * - default
0 * name="default" auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc,aes-256-ctr lifetime=30m pfs-group=modp1024
/ip ipsec> peer print
Flags: X - disabled, D - dynamic
0 address=0.0.0.0/0 local-address=:: passive=no port=500 auth-method=pre-shared-key secret="SharedSecretGoesHere"
generate-policy=port-override policy-template-group=default exchange-mode=main-l2tp send-initial-contact=yes
nat-traversal=yes hash-algorithm=sha1 enc-algorithm=aes-256 dh-group=modp1024 lifetime=1d dpd-interval=2m
dpd-maximum-failures=5
/ip ipsec> mode-config print
Flags: * - default
0 * name="request-only" send-dns=yes