If you have already sent your first subdomain via a tunnel then you should be able to repeat the process with your second subdomain to send that through a tunnel as well. If you’re sending one domain via a tunnel then that should apply to any of its subdomains, so there’s no need to send a nested subdomain via a new tunnel. Do you mean to send your * subdomain via a separate tunnel from the one you’re using for sub1?
I wasn’t aware that nested subdomains are sent via the same tunnel as their parent subdomain. So that’s very good to know for the future.
You are correct in that I was hoping to point sub1 to an IP address and send *.sub1 over the tunnel. Is this possible?