just to proof:

Bordermanager Servers *always* need a fixed assigned public IP address,
there is no way do use dynamic IP addresses + DynDNS, neither for
VPMASTER nor for VPSLAVE servers?

If the public IP address is assigned to the public IF of a 2nd firewall
(or Router) and forwarded (static NAT) to a BM's DMZ IP that is OK?

Thanks, Rudi.