NATing a roadwarrior combined witsh static net tunnels

Hello,

I have a IPSEC gateway that interconnects 3 networks with net-to-net 
tunnels. The ipsec router on each network have fixed ips. Preshared keys 
are used for authentication.

Now, I have to add a road warrior account to this setup, so that a user 
can access all 3 networks. The road warrior will use PSK and has changing 
IPs.

In order to access the 3 networks his (externel IP) needs to be NATed to 
one of the 3 subnet's IPs. How can this be done? I understand that I can 
run customized ipchains/iptables-scripts for each connection. But how can 
ipchains/iptables distinct between the several tunnels? How can only the 
road warrior tunnel be NATed while the other tunnels would just be routed?

Another approach would be to use a second ipsec device for the tunnel. 
Unfortunatley the freeswan box has only one physical ethernet interface. 
Is there any way to set up a second ipsec device on an eth0 alias 
interface?

Thanks in advance!

Joern