I have a client with whom I am setting up a site-to-site VPN connection.  I have done this before but always with private IPs going across the tunnel.  This customer insists that all traffic appear to be from a single public address, with his servers...