Hi,
Office A and Office B both have MT routers and are remote to each other. Would like to have ipip tunnel with security between them. Both Routers use /ip cloud for dynamic dns.

Both routers are behind cable modem. Modem is set to bridge mode in both offices. Both Routers have dhcp enabled routeable IP address on ether1.

The idea is for Office A to backup files from one device to a device at Office B

When setting up /interface ipip the local address was set to the bridge IP address in both MT routers. Added same IPSec password in both Routers. No other configuration was made to IPSec. Not sure if IPSec requires further configuration.

Question is, would it be wise to do dst nat to the ip address of the backup device at YYYYY Office B (image on right side)? Is there a better way with security to accomplish this.?

Basically used the info shown at https://wiki.mikrotik.com/wiki/Manual:Interface/IPIP

The MT router for Office B is not yet there so the above config cannot be tested.