Since this is a point-to-point tunnel, you can get by without assigning IP addresses to the tunnel endpoints and route by tun device instead. It saves some `ip addr` configuration and reduces two NAT (once on leaving local tun and once on the server) to just one NAT (on the server only).