Practically:
SERVER (ip a.a.a.a/24) <-> SNAT (pool b.b.b.b/26) <- VPN -> agent (ip c.c.c.c/24)

Server translated address at time of connection could be b.b.b.1-b.b.b.127.

Solutions  (parameters Servers =, ControlServers =, MasterServers
* define all possible ip address in Servers = ...
* create dns A record with all possible ip addressees and use dns name as parameter value
* create feature request for parameters to accept CIDR notation

Possible solution:
* create feature request to add logic to client:
  if none of  Servers =, ControlServers =, MasterServers =  are defined
  and required authentication+encryption is configured
  allow configuration value 0.0.0.0
  as Servers =, ControlServers =, MasterServers = parameter value.
 
thank you,

Ales