If you only have one IP then regular port forwarding rules would do the same thing you're trying to do with the 1:Many NAT if i'm understanding you correctly?  The difference between regular port forwards and 1:Many NAT is being able to specify a different Public IP than what your primary WAN is. ... View more

If you have access to CMAK i'd suggest using that to build your client VPN.  It's been a while since I used CMAK and set ours up, but after configuring with CMAK you'll get a VPN client exe.  Then you can just double click on it to install on machines, or roll it out however you prefer.  Yes it's old, but still works great.  We are using Radius L2TP/IPSEC with our MX for the windows client VPN.  Here's more info on it: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc752995(v=ws.11)?redirectedfrom=MSDN ... View more

If you go into Security & SD-WAN under the layer 7 firewall rules you can add a layer 7 rule to block countries: Germany.  None of the Teamviewer clients will be able to connect at that point, but it will only apply to the clients on your network the MX is on. ... View more