@cmb:
If the described route is there, it should go out the tunnel as that'll determine its source IP selection. I don't recall anything with DHCP relay that's any different.
The ICMP redirect you're describing would not happen with the described route. It does cause an ICMP redirect to be sent, but it's one that tells the client "to reach the remote IPsec network, hit my LAN IP", which is what they're doing anyway so it effectively does nothing. You can disable the ICMP redirects under System>Advanced, Tuning, if you don't need or want them in general. But that description makes it sound like the route wasn't right to begin with.
Yeah, it did seem weird to me, so I checked it several times, and had a colleague check it for me as well just in case someone spiked something I drank, but the route was fine and that's the redirect the host got. In either case, installing the FreeBSD package mentioned in this post it worked without the route. The only difference I see between the two of them network wise is that the "unofficial" relay binds to a specific address as well as the interface, while the included daemon binds to * on the selected interface.
