I agree that CGNAT causes nightmares. You will need to use OpenVPN with TCP as CGNAT causes all sorts of problems with UDP (MikroTik only supports TCP connections for OpenVPN at the moment and L2TP requires UDP).
Once you have the VPN tunnel setup you will need to:
- Configure port forwarding from the VPS to the MikroTik over the VPN tunnel (Each service will require a unique dedicated port unless you have multiple Internet IPs).
- Configure port forwarding on the MikroTik to the correct device (The external port needs to be unique - if you don't have multiple IPs - but not the port on the receiving device as you can configure port routing based on the incoming port).
This is a
very basic overview of what you will need to do and you can, of course, do much more complex routing if you want.