I will try ask this question in the VPN PBR Forum. This really seems to be the right way. Thanks for the hint!