Hello,
I am sorry but when you say no public IP from ISP and only private IP on the HQ side then how are the users on your HQ side able to go on the internet. Is there a NAT happening on the ISP side to NAT the private IP to public IP.
Also i am not sure if CyberOam supports IP-IP tunnel but SRX does and here is the link for the same:-
https://kb.juniper.net/InfoCenter/index?page=content&id=KB23986&actp=search
But having said that it will still need apublic IP on the outer IP header for the packet to traverse on the internet. So please check if somehow the NAT is there on the ISP side or you get a public IP address to NAT the traffic on SRX itself.
Thanks,
Pulkit Bhandari
Please mark my response as Solution Accepted if it Helps, Kudos are Appreciated too. 
