Proper NAT and Firewall Rules for L2TP Server behind Mikrotik Router - firewall

Question

I have configured Windows Server 2016 for a L2TP VPN connections via pre-shared key. The server's LAN side address is 192.10.0.100. I can access the VPN from the LAN side.
From outside the local network, I get an error message saying "the remote server is not responding" and mentioning the possibility of NAT or firewall issue.
Here are the rules I have put in place for the VPN:
NAT
add action=dst-nat chain=dstnat comment="NAT Rule for L2TP General Port 500" \
dst-address="Mikrotik public IP Address" dst-port=500 protocol=udp to-addresses=\
192.10.0.100 to-ports=500
add action=dst-nat chain=dstnat comment="NAT Rule for L2TP General Port 1701" \
dst-address="Mikrotik public IP Address" dst-port=1701 protocol=udp to-addresses=\
192.10.0.100 to-ports=1701
add action=dst-nat chain=dstnat comment="NAT Rule for L2TP General Port 4500" \
dst-address="Mikrotik public IP Address" dst-port=4500 protocol=udp to-addresses=\
192.10.0.100 to-ports=4500
Firewall:
add action=accept chain=input comment="allow L2TP port 500" dst-port=4500 \
protocol=udp
add action=accept chain=input comment="allow L2TP port 1701" dst-port=1701 protocol=udp
add action=accept chain=input comment="allow L2TP port 4500" dst-port=4500 \
protocol=udp
add action=accept chain=forward comment=\
"Allow forwarding for L2TP VPN (udp)" dst-address=192.10.0.100 \
protocol=udp
It appears the client can contact the server but is getting no response. Is there another NAT for return traffic that I am missing? Thanks in advance.

Answer 1

If you get an error message indicating a problem with firewall, might check your client and server side Registry entries.
The instructions here for setting up an L2TP VPN on a windows server, point out that you have to add a DWord Value to the Registry on both the Server and the client to make the NPS changes work.
Go to
HKEY_LOCAL_MACHINE -> SYSTEM -> CurrentControlSet -> Services -> PolicyAgent
Add
AssumeUDPEncapsulationContextOnSendRule
Change the Value Data to 2.
Turns out you do NOT need that for testing the VPN on the LAN side but do on the WAN side. Consequently, did not think to check my spelling until I was able to connect to the VPN from my MacBook Pro.