This is a test of setting up a VPN in a situation where the ISP has provided a single public /32, it has been *routed* (layer 3) to the customer at a private 10.net address. NOTE: NAT is *not* involved. We will use north, nic, east. .---------. | north | |192.1.3.4| '---------' | 10.1.1.93 | | | 10.1.1.254 .---------. | nic | | | '---------' | .---------. | | east | +-----------------+ | | | '---------' On nic, there is: route add -host 192.1.3.4 gw 10.1.1.93 but nic has no interface on 192.1.3.0/24. On north, one has: ip addr add 10.1.1.93/24 dev eth1 ip addr add 192.1.3.4/32 dev eth1 ip route add 0.0.0.0/0 via 10.1.1.254 src 192.1.3.4 The first problem is that pluto can not see the alias that is made in this way, and so it doesn't know which end of the connection is which.