How to allow VPN traffic in from WAN on both sides?

[2000plusone]

2x MX68 with AutoVPN are connected.
Each one is behind a NAT. I don't want to disturb the existing networks and put clients behind MX. But I do need to jump into the tunnel from both sides. Effectively, it's "Internet" traffic getting into WAN interface and routing into the tunnel. But it's just upstream LAN traffic. I can't figure out how to set this up.
1MX - WAN 192.168.1.26 (upstream gateway's LAN), LAN - 192.168.26.1 - no clients here.
2MX - WAN 192.168.4.26 (upstream gateway's LAN), LAN - 192.168.27.1 - no clients here.

I need 192.168.1.0 and 192.168.4.0 to talk. This is only needed a for a couple of clients, so I can set static routes on them, if necessary, to get to the VPN. In fact, I have this setup already, but MXs don't let packets through. I haven't been able to figure out what happens with them.
I can put static routes into upstream gateways, too, if needed.

[alemabrahao]

I believe you just need to activate auto VPN.

https://documentation.meraki.com/MX/Site-to-site_VPN/Meraki_Auto_VPN_-_Configuration_and_Troubleshoo...

[alemabrahao]

Communication is only between LAN and WAN are used to establish the tunnel.

[PhilipDAth · Accepted solution]

You need to use VPN concentrator mode.  192.168.26.0/24 and 192.168.27.0/24 would cease to exist.  You would only have 192.168.1.0/24 and 192.168.4.0/24 in play.

https://documentation.meraki.com/MX/Deployment_Guides/VPN_Concentrator_Deployment_Guide

With this only the WAN port is used on the MX.  On your existing NAT device, you simply add a static route pointing to the MX for the remote subnets.

There are no changes to the clients or where they plug into the network.