When you deploy a Mikrotik device on your local network, you can use either Winbox or Webfig to configure and manage your device. However, if the device is deployed in another network, behind a NAT, or in a foreign network, for example connected through a LTE access, then it becomes more complex (either Mikrotik device or any server with RouterOS installed) by ensuring an on-demand secured VPN between the device and the Cloutik server.
When you trigger the feature “Enable Webfig”, the device establishes a VPN towards the Cloutik controller. Thus, you get your access to your device to manage it as if it was on your own LAN. This is particularly helpful when your device is behind a NAT-ed Internet access.
Thanks to this feature, you do not need to configure a NAT/PAT rule on your broadband router to get access to your RouterOS-based device.
One requirement : the VPN established by the Cloutik Controller with the device requires a valid communication on port 1194. This port shall not be filtered by a local firewall that would prevent the device to establish the VPN with the Cloutik controller.
Then, if the feature does not work for you, have a look to your network and allow the device to access the cloutik.com domain, it should solve the issue