IPSec vs. NAT vs. Route

David Simmons writes:
 > Here's my current setup:
 > 
 >          Toronto:                                   Dallas:
 > 192.168.1.4<->OpenBSD<->Static<->Internet<->Static<->OpenBSD<->192.168.2.1
 >   ^^Not Gateway                                              IS Gateway^^
 > 
 > [snip]
 > Q:  Do I need to setup NAT on the Unix machine so that it will
 > translate the 'others' network packets to the 'local' (seems
 > counter productive to the whole reason for a VPN)?  Do you just
 > have to manually route each machine? Or do you modify the current
 > Gateway with re-direct type command if packets show up for the
 > alternate network (basically doing a redirect to the new gateway)?

Any/all of these should work to greater or lesser degrees.

Adding the static route to each host on the subnet is logically
simple, and works for packets initiated at either end but is obviously
a maintenance issue if you have machines on the subnet that come and
go.

Using NAT is simple, you just add one NAT rule.  This solves the
problem of any Toronto->Dallas traffic that is a reply to a
Dallas->Toronto packet but it doesn't help with traffic initiated from
Toronto->Dallas since that would still go to the default gateway and
hence not over the IPsec tunnel.  For that you'd need to a route on
the gateway to direct 192.168.2.0/24 to 192.168.1.4.  This is
manageable for two offices, but not much fun if you have multiple
connections, especially if they come and go. 

If you run a routing daemon on the VPN box and the Gateway then you
could have the VPN box advertise the 192.168.2.0/24 route so the
Gateway will forward packets correctly and issue the re-direct so that
future packets go directly to the VPN box.