Yeah because the vpn is sharing the same lan subnet you will require that.

Cyril

Wonder if router needs a reboot after enabling proxy-arp

DNS resolution still not working, do I need to ensure FW allows port 53 through? Thinking remote requests?

You just need "Allow Remote Requests" turned on, but then insure you have a rule to block DNS requests from the WAN interface.

No need to reboot after enabling proxy arp - maybe just disconnect/reconnect the VPN interface at the most.

And possibly add the VPN interface to the "Lan Interface" list will sort out any other firewall related issues.

Cyril

Here is the firewall 

I have left it as the default only adding the L2TP ports

^ Give that accept rule a comment of "Accept L2TP-IPSec"

Move it down after the rule to accept ICMP so that you don't accept invalid traffic to your VPN server.

Make sure that you've set the bridge on the PPP profile to be your LAN, and it's on the LAN interface where you set ARP to proxy-arp.

This page was one of the best set up guides:

A Day in the Life of Just Another IT Guy » L2TP with IPSec on Mikrotik RoutersOS (archive.org)

It's a little different now with updated ROS version but should work fine.  It will allow a connection from both iPhones and Windows, all instructions provided.

Cheers MadEngineer!