Yup this did the trick. I added netmasks for all four of our subnets, and
also added permanent routes for the two subnets we were using as dial-in
routes so that the subnet route pointed through the first address in the
subnet, which is the address the machine is assigned when it dials in. All
works well now.