Maestro Sometimes Works, Sometimes not over my VPN environment

I have recently obtained a Maestro.  It sometimes works and sometimes doesn't.  I don't know what I do differently when it does and when it does not. 

The environment is fairly complex and may not be what Smartlink expects to see.

At the remote site:

1.  A router at the remote site that automatically sets up a network on 192.168.**.?  It is on this VPN where the rig sits and the registration is done.  If the system worked ideally, Maestro would see the address of the rig on this VPN.

2.  A router at the local (home) site that automatically sets up a network on 192.168.##.?.  It is on this subnet where the Maestro sits and where my existing Remoterig solution has accessed the remote site (over a well-proven VPN connecting the subnets) for over three years.  Maestro sometimes "sees" the other network in some manner and sometimes has some sort of half-baked visibility to it but doesn't really work.

Note that the two address sets are separate.  For instance, ## might be 00 and ** might be 01.  But, the VPN setup is such that each understands the other and if you simply use the right 192.168.??.? address on either side, everything is forwarded via the VPN and all works well.  Or, at least for everything but Maestro.

When it works, even when the network connection is rated poor, I can get Maestro to function OK.  After some other debug work (this is all new), I have CW and SSB working and can make contacts, including activating my amp and so on. 

When the connection to Maestro fails, I basically get nothing.  I get a strange, truncated kind of display and nothing "actionable" such as slices to work with.

I have indications that on the rig side, everything is based on the 192.168.**.?? subnet.  I have indications that on the Maestro side, it sees the ISP address of the remote system and not the VPN address.   That is to say, the rig appears to be visible via "network translation" (NAT to be precise) as far as Maestro goes.  If that is really true, I can't account for how it works.  There are _no_ entries for port forwarding in either router -- these are routers I have carefully set up and I know the contents far more than most people.

In fact, I have quite deliberately made no provision for port forwarding in either firewall.  I should not need it -- I already have a well-proven VPN.  All I need is for it to be reliably used.

It is hard for me to explain why it works at all since (if the Maestro really doesn't see the VPN address of the rig).

Here are some images: