IPSec vs. NAT vs. Route

First off, I'd like to thank those who recently helped shed some light onto
the whole topic of secure VPN connections!

It seems like I'm missing the last piece of the puzzle that stumps me as to
the best approach to take:  NAT / Route / rdr ??

Alot of this roots back to one of my original questions that I haven't found
a good answer on, how does a network route traffic to this VPN connection
without a change in Gateways?

Here's my current setup:

         Toronto:                                   Dallas:
192.168.1.4<->OpenBSD<->Static<->Internet<->Static<->OpenBSD<->192.168.2.1
  ^^Not Gateway                                              IS Gateway^^

While I currently have encrypted connections running between the two Unix
machines (with Windows users 'past' them) - it seems I still have a routing
problem, because I can ping in one direction, but can't the other.  While
working on one machine in Toronto, if I add a static route to the new
network with a different gateway, it worked liked a charm (using:  route add
192.168.2.0 mask 255.255.255.0 192.168.1.4)...and it keeps aludes me as to
how the packets will find the 'new' network without a proper gateway or
route? (ie. I'd like to NOT have to manually type a route command on all
machines)

Q:  Do I need to setup NAT on the Unix machine so that it will translate the
'others' network packets to the 'local'(seems counter productive to the
whole reason for a VPN)?  Do you just have to manually route each machine?
Or do you modify the current Gateway with re-direct type command if packets
show up for the alternate network (basically doing a redirect to the new
gateway)?

Thanks again...I can see the light...and I'm hoping it's not the oncoming
train....

dave