asterisk users - Mar 2005 - SIP Dial between two IAX-connected boxes?

Hello,

I'm pretty new to asterisk (only been fighting with it on and off for
about the last month), so please go easy.  I've been wrestling with the
documentation, forum posts, google, and my lack of telephony and VOIP
knowledge, trying to get my setup to work.  My current problem has me
stumped saying, "There's gotta be a cleaner way to do this." 
Please
show me the light and be kind if I'm using the wrong terms.  I'm working
on a SIP-only VOIP system.

I have two Asterisk servers.  One server (A) is behind a (NATing)
firewall and the other (B) is in a DMZ.  A and B communicate via IAX2.
In A's dialplan, when it detects a SIP call (essentially using the rules
presented here: http://slacker.com/~nugget/asterisk7.php), instead of
trying to make the call itself, I'm trying to use Dial to connect to B
via IAX.  B would then assign the SIP call to a context that would
actually make the call.

I'm currently stumped by what seems to be IAX's choking on the
"@"
character.  To maintain the SIP domain, I use something like the following:

exten => _.,7,Dial(IAX2/foo:bar@IPB/${EXTEN}@${SIPDOMAIN})

If I use this, though, B always rejects the connection:

Mar 18 18:51:27 NOTICE[22444]: chan_iax2.c:6098 socket_read: Rejected
connect attempt from IPA, who was trying to reach 'dev@null.com'

If I change the Dial rule so that the "@" is replaced with another
character, such as an "=", the connection is authenticated and
accepted.
 Of course, this leads to another problem: mapping the "=" back to an
"@", but that's a battle for another day.

My main questions are:

1.  Is what I'm doing sane?
2.  Is there another/better way to do this?
3.  What do other people who have to deal with NATs and firewalls do for
a SIP-only solution?

Thanks,
pete