First off I don't claim to know much about VPNs and encapsulation.  

Everyone I talk to tells me openvpn should do what I want.  

I take it that is a state full type of connection?

Brian, the problem I see if if I setup another rip44 listener gateway, how do I 
direct the encapped traffic to our natted, internal IP?  An entry in the portal 
will get it to their router (outside address), but having them place a 

forwarding rule to get it from there to out 192 internet address probably won't 
happen.

---- Quote------

On Wed, Apr 17, 2013 at 12:38:01AM -0500, kb9mwr at gmail.com wrote:
> It doesn't really make sense to put another gateway in the portal, as I
> doubt the rip packets will pass though.

The AMPRNet internal RIP packets from 'amprgw' are sent encapsulated,
so if you can do IP-IP tunnels at all, the RIP should get through too.

One way to see whether a firewall will pass IP-IP tunnels is to add
its address as a gateway and see if you get tunnel traffic on the other
side.  Since the internal RIP is sent every 5 minutes, it can be a simple
test of your incoming connectivity.
	- Brian