Split out the tunnel open so it can be done in a different network namespace.