just to get it confirmed:

a VPSLAVE server cannot be at the same time a VPMASTER?

So if a Customer wants to have client-2-site VPN services,
the users have to do a C2S-VPN connetion to the VPMASTER's
site and access the servers of the VPCLIENT servers site
through the S2S-tunnel, right?

Thanks, Rudi.