Wait, I just thought of something: the Astaro is just a node on the 10.0.1.0/24 network at the moment; 10.0.1.5's default gateway is a router than knows nothing of the Astaro. Is there no route back to the tunnel's source host (192.168.0.100) without masquerading?