The default IT policies don't allow split-pipe connections. To enable, you will need to convince the BES admin to change the IT policy (not likely).

The good news is that if MDS is enabled on the BES, you can just use that to connect to the outside world and skip the WAP gateway.