Try to modify the provisioning of the Extension to use FQDN, and then reprovision the client
Once both the in office and out office registrars change in the app, it will be forced to use the tunnel.
To test if it works, goto the dashboard, and look at the event log. You will see the extension register via IP 127.0.0.1