Make use of ipsets. Make tunnel use public IPs to fix routing issues from the host itself.
Fix tunnels to use public IP space to prevent routing issues.