The way I understand it, all traffic does go the VPN (there is no split-tunneling) when I connect to the VPN. You are exactly correct in that my VPN (Cisco PIX) does not forward traffic destined for outside (internet) addresses, which is precisely why I am forced to use a local Linux machine running SSH to forward my web traffic between my VPN hosts and the internet.

It's possible that this setup is entirely flawed, I would be grateful to hear other suggestions on getting my VPN hosts to reach the Internet.