Mikrotik：防火墙丢包，即使规则似乎匹配

我在Mikrotik上build立了一个L2TP VPN服务器。 当我在路由器后面连接到VPN时，但是一旦从WAN端连接，它不会。 我login了我的防火墙，看看是否使用默认的丢弃规则删除它，它是：

WANDROP input: in:ether1-gateway out:(none), src-mac 00:00:5e:00:01:66, proto UDP, 5.6.7.8:38211->1.2.3.4:500, len 412 

但是我的规则是这样设置的：

 add action=accept chain=input dst-address=1.2.3.4 dst-port=500,1701,4500 in-interface=ether1-gateway log=yes protocol=udp src-address=0.0.0.0 add action=accept chain=input dst-address=1.2.3.4 in-interface=ether1-gateway log=yes protocol=ipsec-esp src-address=0.0.0.0 add action=drop chain=input comment="default configuration" in-interface=ether1-gateway log=yes log-prefix=WANDROP add action=accept chain=input comment="default configuration" connection-state=established,related add action=accept chain=forward comment="default configuration" connection-state=established,related add action=drop chain=forward comment="default configuration" connection-state=invalid add action=drop chain=forward comment="default configuration" connection-nat-state=!dstnat connection-state=new in-interface=ether1-gateway log=yes log-prefix=DROP /ip firewall nat add action=dst-nat chain=dstnat dst-address=1.2.3.4 dst-port=80 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.232 to-ports=80 add action=masquerade chain=srcnat comment="default configuration" out-interface=ether1-gateway 

不知道我在做什么错或失踪。