I will describe my setup, which is working, maybe you'll get some ideas.
So I have a DSL modem followed by a router and then my server on which the
tunnel endpoint resides.
The DSL modem is set to bridge mode and I do the PPPoE authentication on the
router (I don't think this is relevant).
Now, on the WAN port I got my public IP and have a firewall route forwarding
protocol 4 to my server. Your DMZ essentially does the same in a more
general way, ensuring the proper NAT.
Now to the tunnel.
My internal IP on the router is 10.10.74.2, the server ip is 10.10.74.1.
My tunnel interface: address 44.182.21.1 netmask 255.0.0.0
Startup command sequence:
ip tun add ampr0 mode ipip local 10.10.74.1 (<-- this is the local interface
address)
ip route add default via 169.228.66.251 dev ampr0 onlink table default (<--
this is the amprgw peer which goes into table "default")
ip rule add from 44.182.21.1 table default (<-- anything coming to my server
from this interface will use the "default" routing table)
ip rule add from 44.182.21.1 to 44.0.0.0/8 table main (<-- anything going to
other 44 addresses will use table "main")
ip route del 44.0.0.0/8 (<-- delete the route created automatically for this
interface so that connections to 44 addresses not in the routing table go
via regular internet and not via tunnel)
After this I start the rip44d daemon:
rip44d -I ampr0 -p HereComesThePassword -a 89.x.x.x (All routes from rip
broadcasts will go into the table "main" and your local public infos IP will
be discarded)
This setup ensures that any connection request arriving via tunnel will go
back the way they came in, the rest will be routed according to the "main"
routing table.
Now, if I run some tracing program like wireshark, I see ripv2 packets on
the ampr0 interface, which is my tunnel interface.
Maybe this helps.
Marius, YO2LOJ