Не могу разобраться с подключением через winbox по vpn

Здравствуйте, в сети имеется несколько устройств mikrotik (цепочка: rb1100>crs326>crs326) все прекрасно работает, но есть загвоздка с тем что по VPN я могу зайти только на главный rb1100, остальные даже не пингуются ... везде настроен mgmt под vlan для внешних соединений .... если подключаться находясь на любом рабочем компьютере внутри локалки, то все происходит без проблем кроме внешнего подключение в сеть ... адрес для внешний сети указан 192.168.98.0/24

Спойлер: RB1100

/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=VLAN21 vlan-id=21
add interface=bridge1 name=VLAN22 vlan-id=22
add interface=bridge1 name=VLAN23 vlan-id=23
add interface=bridge1 name=VLAN24 vlan-id=24
add interface=bridge1 name=VLAN25 vlan-id=25
add interface=bridge1 name=VLAN26 vlan-id=26
add interface=bridge1 name=VLAN27 vlan-id=27
add interface=bridge1 name=VLAN98 vlan-id=98
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
set 12 default-vlan-id=0
set 13 default-vlan-id=0
set 14 default-vlan-id=0
set 15 default-vlan-id=0
/interface list
add name=MGMT
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec peer
add local-address=192.168.98.1 name=peer2 passive=yes
/ip ipsec policy group
add name=MGMT
/ip ipsec profile
add enc-algorithm=aes-256,aes-192,aes-128,3des name=MGMT
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=\
aes-256-cbc,aes-192-cbc,aes-128-cbc,3des
add enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des name=\
MGMT-proposal pfs-group=none
/ip pool
add name=POOL21 ranges=192.168.21.100-192.168.21.200
add name=POOL22 ranges=192.168.22.100-192.168.22.200
add name=POOL24 ranges=192.168.24.100-192.168.24.200
add name=POOL25 ranges=10.1.25.100-10.1.25.200
add name=POOL23 ranges=192.168.23.100-192.168.23.200
add name=POOL98 ranges=192.168.98.10-192.168.98.20
add name=POOL26 ranges=192.168.26.100-192.168.26.200
add name=POOL27 ranges=192.168.27.100-192.168.27.200
/ip dhcp-server
add address-pool=POOL22 interface=VLAN22 lease-time=1d10m name=DHCP22
add address-pool=POOL24 disabled=no interface=VLAN24 lease-time=1d10m name=\
DHCP24
add address-pool=POOL25 disabled=no interface=VLAN25 lease-time=12h name=\
DHCP25
add address-pool=POOL21 disabled=no interface=VLAN21 lease-time=1d10m name=\
DHCP21
add address-pool=POOL23 interface=VLAN23 lease-time=1d10m name=DHCP23
add address-pool=POOL98 disabled=no interface=VLAN98 lease-time=1d10m name=\
DHCP98
add address-pool=POOL26 disabled=no interface=VLAN26 lease-time=1d name=\
DHCP26
add address-pool=POOL27 disabled=no interface=VLAN27 lease-time=1d name=\
DHCP27

/ip ipsec mode-config
add address-pool=POOL98 name=MGMT-conf
/ppp profile
add change-tcp-mss=yes local-address=192.168.98.1 name=MGMT remote-address=\
POOL98 use-encryption=yes
add change-tcp-mss=yes local-address=192.168.21.1 name=VLAN21 remote-address=\
POOL21
add dns-server=8.8.8.8,8.8.4.4 local-address=192.168.98.1 name=MGMT-L2TP \
remote-address=POOL98
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=ether2
add bridge=bridge1 hw=no interface=ether5 pvid=98
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/interface bridge vlan
add bridge=bridge1 tagged=ether2,bridge1 untagged=ether5 vlan-ids=\
21,22,23,24,25,26,27,98
/interface list member
add interface=VLAN98 list=MGMT
/interface pptp-server server
set enabled=yes
/ip address
add address=192.168.22.1/24 comment=SIP interface=VLAN22 network=192.168.22.0
add address=192.168.23.1/24 comment=CAM interface=VLAN23 network=192.168.23.0
add address=192.168.24.1/24 comment="Wi-Fi Work" interface=VLAN24 network=\
192.168.24.0
add address=10.1.25.1/24 comment="Wi-Fi Guest" interface=VLAN25 network=\
10.1.25.0
add address=192.168.21.1/24 comment="Work Lan" interface=VLAN21 network=\
192.168.21.0
add address=192.168.98.1/24 comment=Managemet interface=VLAN98 network=\
192.168.98.0
add address=84.47.160.42/29 interface=ether1 network=84.47.160.40
add address=192.168.26.1/24 comment=TV interface=VLAN26 network=192.168.26.0
add address=192.168.27.1/24 comment="For DJ" interface=VLAN27 network=\
192.168.27.0
/ip dhcp-server network
add address=10.1.25.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=10.1.25.1
add address=192.168.21.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.21.1
add address=192.168.22.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.22.1
add address=192.168.23.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.23.1
add address=192.168.24.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.24.1
add address=192.168.26.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.26.1
add address=192.168.27.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.27.1
add address=192.168.98.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.98.1
/ip firewall service-port
set ftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
/ip ipsec policy
add dst-address=192.168.98.0/24 group=MGMT proposal=MGMT-proposal \
src-address=0.0.0.0/0 template=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www address=192.168.98.0/24
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.98.0/24,192.168.21.2/32
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Moscow
/system clock manual
set dst-delta=+03:00
/system identity
set name=marikorestaurantyandexru_1
/system ntp client
set enabled=yes primary-ntp=88.147.254.230 secondary-ntp=88.147.254.232
/system ntp server
set enabled=yes
/tool mac-server
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT
#error exporting /tool sniffer

Спойлер: CRS326

/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=VLAN21 vlan-id=21
add interface=bridge1 name=VLAN22 vlan-id=22
add interface=bridge1 name=VLAN23 vlan-id=23
add interface=bridge1 name=VLAN24 vlan-id=24
add interface=bridge1 name=VLAN25 vlan-id=25
add interface=bridge1 name=VLAN26 vlan-id=26
add interface=bridge1 name=VLAN27 vlan-id=27
add interface=bridge1 name=VLAN98 vlan-id=98
/interface list
add name=MGMT
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge1 interface=ether3 pvid=21
add bridge=bridge1 interface=ether4 pvid=21
add bridge=bridge1 interface=ether5 pvid=21
add bridge=bridge1 interface=ether6 pvid=21
add bridge=bridge1 interface=ether7 pvid=21
add bridge=bridge1 interface=ether8 pvid=21
add bridge=bridge1 interface=ether9 pvid=21
add bridge=bridge1 interface=ether10 pvid=21
add bridge=bridge1 interface=ether11 pvid=21
add bridge=bridge1 interface=ether12 pvid=21
add bridge=bridge1 interface=ether13 pvid=21
add bridge=bridge1 interface=ether14 pvid=21
add bridge=bridge1 interface=ether15 pvid=21
add bridge=bridge1 interface=ether16 pvid=21
add bridge=bridge1 interface=ether17 pvid=21
add bridge=bridge1 interface=ether18 pvid=21
add bridge=bridge1 interface=ether19 pvid=22
add bridge=bridge1 interface=ether20 pvid=22
add bridge=bridge1 interface=ether21 pvid=22
add bridge=bridge1 interface=ether22 pvid=22
add bridge=bridge1 interface=ether23 pvid=22
add bridge=bridge1 interface=ether24 pvid=22
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridge1 interface=sfp-sfpplus1 pvid=23
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=sfp-sfpplus2
add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=ether2
/ip neighbor discovery-settings
set discover-interface-list=MGMT
/interface bridge vlan
add bridge=bridge1 tagged=ether1,ether2,sfp-sfpplus2,bridge1 untagged="ether3,ether4,ether5,ether6,ether7,ethe\
r8,ether9,ether10,ether11,ether12,ether13,ether14,ether15,ether16,ether17,ether18,ether19,ether20,ether21,\
ether22,ether23,ether24,sfp-sfpplus1" vlan-ids=21,22,23,24,25,26,27,98
/interface list member
add interface=VLAN98 list=MGMT
/ip address
add address=192.168.98.2/24 interface=VLAN98 network=192.168.98.0
/ip route
add distance=1 gateway=192.168.98.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.98.0/24,192.168.21.2/32
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=Mariko2
/system ntp client
set enabled=yes primary-ntp=192.168.21.1
/system routerboard settings
set boot-os=router-os
/tool mac-server
set allowed-interface-list=MGMT
/tool mac-server mac-winbox
set allowed-interface-list=MGMT

 

Илья большое спасибо !!! , подтолкнули в нужную сторону, причем на работе сеть была выставлена правильно, но делал давно и про proxy-arp на новом объекте вылетело из головы .... а 98ю подсеть сделал как раз именно под vpn, она же и является только для обслуживания сети из вне.