Our VPN concentrator serves several clients from one address. Will Passbeam tell them apart?

Yes, and the address is not how it does it. Passbeam works out which client a request belongs to from which shared secret verifies the packet — every request carries a signature over its own contents, and only the right secret reproduces it. The source address only narrows the list of candidates to try.

So one concentrator on one public address can serve any number of your clients. Give each client their own VPN gateway with its own secret, register the same public address on each, and every request lands in the right place. Two clients behind one address is the normal MSP arrangement rather than an edge case.

One number worth knowing: up to 32 VPN gateway registrations may share a single address. That is a ceiling on the work one packet can cost us, not a licence limit, and it is far past any real arrangement — but if you run a concentrator for more than thirty-two clients, tell us before you get there.