in particular the bit 4.1-b where I did not create a new interface but simply assigned the tun interface to the firewall zone.
Is there a way to "name" these tun interfaces?
One solution could be to ensure all vpn clients are running and then just switch tun is assigned to the firewall wan zone. Better if their tun is named statically.
or, opposite
Ensure only one vpn client is running, they all call their tun devices the same so the wan firewall does not need to change.
And, ideally I would like to switch it off when not needed.
I think it is more proper to create multiple configurations in step 2 and change the remote server only. Name the configs accordingly.
All of them can be in the same firewall zone.
Make sure they are not starting on boot, as your provider might not like your multiple connections.
What about I only have 1 vpn client in the gui with a configuration file which is a symbolic link, then I programmatically stop / start the client and swap the conf files.
There used to be some luci application to run custom commands, but I cannot seem to find it anymore.
You can add them all with option device tun+
Or you can create unmanaged interfaces where the VPNs will be bound and use the network interface name in the firewall zone.