I was just thinking of trying to do similar. The main thing I’d deviate from this configuration is using masquerading- for a multiuser setup you’d want an ip pool and arp for one address per tunnel.
Trying to diagnose issues or track traffic per user becomes nigh impossible transiting a PAT-NAT.
Trying to diagnose issues or track traffic per user becomes nigh impossible transiting a PAT-NAT.