Thanks for the pointer, it seems it’s an DNS issue after all (IT’S ALWAYS DNS). Routing all traffic through the tunnel forces the Clients to use the DNS server of the LAN. Without, my internal websites (which use a public domain namespace) are sometimes resolved with a public DNS. So the browser doesn’t request test.home.network (10.0.0.100) but test.home.network (1.19.72.59).