Front door vrfs in a tunneled environment are really quite cool. This vrf has an independent routing table and default route allowing. Connect to the mpls wan or internet 9.