Homeoffice VPN Mikrotik eigenes VLan?

/ip firewall filter add chain=forward src-address=10.11.12.5 dst-address=10.99.0.0/24 action=accept
/ip firewall filter add chain=forward dst-address=10.99.0.0/24 action=reject

{
# ======================
# SOPHOS IKEv2 S2S VPN
# ======================

# Preshared Key
:local PSK "Passw0rd"  
# remote public ip
:local REMOTEIP 1.2.3.4
# local public ip
:local LOCALIP 3.4.5.6
# local subnet
:local LOCALNET 192.168.100.0/24
# remote subnet
:local REMOTENET 172.16.16.0/24

# add ikev2 peer
/ip ipsec peer add address=$REMOTEIP exchange-mode=ike2 name=sophos profile=profile_sophos
# add phase1 proposals
/ip ipsec profile add enc-algorithm=aes-256,aes-128 hash-algorithm=sha256 lifetime=8h name=profile_sophos
# add phase2 proposals
/ip ipsec proposal add auth-algorithms=sha256 enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=1h name=proposal_sophos pfs-group=modp2048
# add phase2 sa policy
/ip ipsec policy add src-address=$LOCALNET dst-address=$REMOTENET level=unique peer=sophos tunnel=yes
# add peer auth identities (PSK)
/ip ipsec identity add my-id=address:$LOCALIP peer=sophos remote-id=address:$REMOTEIP secret="$PSK"  
}
 

{
# =====================================
# Mikrotik => SOPHOS-Firewall L2TP o. IPSec VPN
# =====================================

# Preshared Key
:local PSK "Passw0rd"  
# Username
:local USERNAME "MaxMuster"  
# User-Password
:local PASSWORD "Passw0rd"  
# remote public ip
:local REMOTEIP 1.2.3.4
# local subnet
:local LOCALNET 192.168.100.0/24
# remote subnet
:local REMOTENET 172.16.16.0/24
# remote LAN IP of Sophos Firewall
:local REMOTEGWIP 172.16.16.1
# =====================================

# add l2tp profile
/ppp profile add name=profile_sophos_l2tp remote-address=$REMOTEGWIP
# add l2tp-client interface
/interface l2tp-client add connect-to=$REMOTEIP disabled=no ipsec-secret="$PSK" name=l2tp-sophos user="$USERNAME" password="$PASSWORD" profile=profile_sophos_l2tp use-ipsec=yes  
# add route to remote subnet
/ip route add dst-address=$REMOTENET gateway=$REMOTEGWIP
# masquerade traffic originating from local lan out l2tp interface
/ip firewall nat add action=masquerade chain=srcnat out-interface=l2tp-sophos src-address=$LOCALNET
}