>I am busy setting up an IPSec tunnel as well. Is the only solution here to
>have two separate boxes as gateway stages, the outer one unpacking the
>IPSec, and the inner one doing the IP Filtering and NAT?

	i guess so at this moment.

	i have sent a patch for 1.5.1_ALPHA to tech-net, however i have never
	got any comments (if the patch works better, or worse) so i am
	unable to merge it into 1.5.1_ALPHA.

itojun