If you only have one IP then regular port forwarding rules would do the same thing you're trying to do with the 1:Many NAT if i'm understanding you correctly?  The difference between regular port forwards and 1:Many NAT is being able to specify a different Public IP than what your primary WAN is. ... View more

If you have access to CMAK i'd suggest using that to build your client VPN.  It's been a while since I used CMAK and set ours up, but after configuring with CMAK you'll get a VPN client exe.  Then you can just double click on it to install on machines, or roll it out however you prefer.  Yes it's old, but still works great.  We are using Radius L2TP/IPSEC with our MX for the windows client VPN.  Here's more info on it: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc752995(v=ws.11)?redirectedfrom=MSDN ... View more

If you go into Security & SD-WAN under the layer 7 firewall rules you can add a layer 7 rule to block countries: Germany.  None of the Teamviewer clients will be able to connect at that point, but it will only apply to the clients on your network the MX is on. ... View more

We have used Comcast.  I've always put the Comcast modem in bridge mode with a static IP purchased from them.  From the MX side login locally to the firewall via IP (not the dashboard) so you can set the static ip address info for your "wan 2".  You'll need to enter the IP, Gateway, Subnet etc.  First thing:  You will need to call Comcast support to have them put modem into bridge mode.  Second: login to your MX locally so you can enter the network details for WAN2.  Then you can test it out some more by unplugging your WAN1.  Also check the appliance status via the meraki dashboard.  Your primary connection should show as "active" and the secondary should show as "ready".  If it doesn't show as ready something is wrong with the config. ... View more

"Remote User" protocols are PPTP and L2TP on the unifi controller "Client" is PPTP "Site to Site" is either Auto IPSec VTI, or Manual IPsec (auto ipsec probably only works with all unifi hardware   I am kind of confused why OP doesn't use Client VPN on the Meraki device.  If you do setup another VPN (where there's two on your network) I've had best luck with site to site.  It's always on and working, no end user setup or logon needed.       We have about 20 teleworker gateways.  A mix of Z3's and Z1's.  The USG's are kind of trash for using as a router.  Lots of people have said that and they've come a long way, but still far from Meraki and PFsense ... View more

Yes the site to site VPN options are IPsec or OpenVPN.   ... View more