@peterlinux
If there is only a single client connected to the server, the CSO is not necessary in fact. But in this case you have to use a /30 tunnel network and set the "remote networks" on both site, server and client.