Ronen,
Let me understand...
Where is the client located (what country)?
If the client is in Israel (IL), their Syn packet:
- Leaves the Public IP in IL and goes to AMPRGW in California - Is encapsulated and leaves California for your tunnel in IL with an IPENCAP header - You encapsulate a reply with a Syn-Ack to the client, it leaves IL for California - it is de-encapsulated and sent from California to the client Public in IL
Can you provide ping and/or traceroute results to the host IP and AMPRGW?
- Lynwood KB3VWG