Dan,
The reason your AMPR traffic does not yet work - is because you haven't
yet created an IPENCAP tunnel to listen on cnmac0 that will decapsulate
the IP traffic and forward/bridge/NET/etc. it to the network located at
cnmac2.
At this point, you're still looking at the encapsulated IPENCAP traffic
with the additional Public IP header included. The tunnel interface
strips this header - and your traffic will be ready for your local 44
subnet.
Hopefully, someone can provide you information on IPENCAP in BSD (once
you receive it, consider making a BSD page on the Wiki site).
73,
KB3VWG