It's right there, in the man page:
Specifies that connections to the given TCP port or Unix socket on the local (client) host are to be forwarded to the given host and port, or Unix socket, on the remote side.
Specifies that connections to the given TCP port or Unix socket on the remote (server) host are to be forwarded to the local side.
Your issue relates to especialities of the linux connection tracker.
The quick answer: you cannot avoid this delay in your configuration. Only way is avoid this issue is usage the -j SNAT without a port number specification in the --to-source option.
There is also a little trick, that can little help you - use in the j SNAT the range of ports instead ...
Mikrotik RouterOS based on the Linux kernel and has inherited most of the conceptions of networking.
So, I'll describe the setup of the port forwarding in the Mikrotik routers. And I'll try to describe your issue.
If you want to understand it more deeply, you can read the iptables tutorial. It's pretty cool documentation with detailed explanations.
The logs should hopefully be helpful for you, replace Warning with Fatal as these are fatal errors preventing connections.
For openvpn the remote and local settings should match especially those for Key exchange.
For the warning regarding MTU set link-mtu to a common known good value such as 1500 on both remote and local as this will prevent fragmentation....