You need to enable the port your using to tuner admin in the VPN. The use the ip of the endpoint to manage it. And you need to enable this property on the endpoints.
Just my two cents ... .. Provided that the IP's are static ... hardcode the hostnames in the hosts file of the CMS machine or have DNS records for each of them?
But, the VPN IP will change per host based on DHCP issue to host. Most network use DHCP for the VPN right? If you assign statically IP in the CMS host file. You end-up connecting to the wrong host.
In that case it wont help hardcoding the IP in host file ... along with the property Young suggested you will need to change the marimba.tuner.iphost.expire=0 so the endpoint will not cache the property of the source transmitter and do a fresh DNS lookup each time the channel goes for an update... default is -1 meaning that it would never expire..