Network Layout
----------------

-------------        --------                     --------------  
|VPN endpoint|  ---> | NAT   | <--> Internet <--> | NAT/Endpoint| 
-------------        ---------                     -------------


My ipsec.conf looks like:

# cat /etc/ipsec.conf 
# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.4 2006/07/11 16:17:53 paul Exp $

# This file:  /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version	2.0	# conforms to second version of ipsec.conf specification

# basic configuration
config setup
	# plutodebug / klipsdebug = "all", "none" or a combation from below:
	# "raw crypt parsing emitting control klips pfkey natt x509 private"
	# eg:
	# plutodebug="control parsing"
	#
	# Only enable klipsdebug=all if you are a developer
	#
	# NAT-TRAVERSAL support, see README.NAT-Traversal
	nat_traversal=yes
	# virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
	#
	# enable this if you see "failed to find any available worker"
	nhelpers=0

# Add connections here
conn local-remote
	left=<local network external ip>
	leftsubnet=192.168.42.0/24
	leftid=@<local.externally.resolving.fqdn>
	leftrsasigkey=0sAQNdkdU23IAcEFEy9HKDEb3MuYZsuy..(blah blah blah)
	leftnexthop=%defaultroute
	right= <external IP of remote network> 
	rightsubnet=192.168.10/24
	rightid=@<remote.externally.resolving.fqdn>
	rightrsasigkey=0sAQOoK6vRi...(blah blah blah)
	rightnexthop=%defaultroute
	auto=add
# sample VPN connections, see /etc/ipsec.d/examples/

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf