bind puppet agent to specific address

Hi, i have a firewall with some ipsec openswan tunnels. the puppet master is on a tunneled network. it is reachable over a specific interface, which isn't the default one. when i use fping with source ip i can contact the puppet master. so is there a a way to the the puppet agent should use a specific interface of like 192.168.0.2 to reach the puppet master? bindaddress does not work. or how is this supposed to work? the agent is not listening on any port, or is he? in ipsec there is no device for the tunnel, so i can't do a route or so.