ZTE MF283+ Router: Configure Port Forwarding for RDP Access to Computer (10.0.0.100, Port 5000)

Welcome. I have a strange problem with my friend. Namely, he got a ZTE MF283 + router and would like to be able to connect to his computer via RDP (mstsc).

The whole can be connected in two ways:
1 MF283 + -> switch and then to computers (switch creates subnet 10.0.0.x)
2. MF283 + -> Stationary router -> switch and then to computers.

I would prefer the first option because ZTE broadcasts a wifi signal anyway. Everything ok works locally. Internet in computers is, wifi is. There is no problem here. How to "get" from the outside to this router and redirect ports for each computer.

I would like to get a connection to the address 10.0.0.100 after port 5000 from the outside, that is, as I understand going on this way: XXX.XXX.XX: 5000, where XXX.XXX.XX is the public address provided by the provider. Can it be done directly in the ZTE router settings? Kind of tried, but something on the average wants to work. No problem "local" will connect to the desired address from another computer via RDP.

I may understand this wrongly, but the path should look like this after entering the address XXX.XXX.XX: 5000 on any computer, the computer "finds the router - entering it detects a redirection to the address 10.0.0.100. Is it good?

I will be grateful for your help.

And in his LTE service, does he have a public address? Probably not.?

Yes, MF283 + configured by vpn profile together with a helpline technician. Unfortunately, it doesn't work.

As I understand it correctly, if MF283 + transmits IP addresses in the subnet 192.168.0.X then the computer addresses must also be from the same subnet, right? And if I want to enter from the MF283 + network to the stationary router (easier configuration, because there are already redirections and the entire subnet), then I just need to provide the WAN public IP address of MF283 +, the gateway of the mobile router MF283 + and DNSY provider, yes? Is he up to?

Do you get in the router logs that there was a VPN login attempt and what does it mean that the hotline has set up your VPN profile?

I am not sure if MF283 can redirect ports as standard, and this is the basis for any external access to work.
Maybe after ssh / telnet something can be set, e.g. iptables, then some stripped linux controls this modem.
I found a page about combining with configuration scripts:
http://my-router.blogspot.com/2015/09/zte-mf823-4g-change-ip-of-modem-and-get.html