Jim,
Your question sounds similar to one I just asked last week. In my case, convincing the IT department to forward IPIP to our internal address isn't likely.
So I have been playing with OpenVpn, and started documenting things. It looks like it will do what I want. Requests will come to my IPIP Rip gateway, which will also double as an OpenVPN server, and I'll route the traffic though that statefull connection.
I have been trying to track down notes/papers/documents that might be of use: http://www.qsl.net/k/kb9mwr//wapr/tcpip/index.html
Speaking of which, does anyone else have any recommendations on things that have been written over the years?
I swear I am the only ham in my local club that has at least a basic understanding of TCP/IP. So anything I can use to help explain things to newbies would be helpful. I usually just reference the O'Reilly Books, TCP/IP Administration comes to mind.
Has anything ever been written explaining DNS records with a ham slant?