Usando um cliente VPN como um gateway de VPN

Question

Gostaria que o host 1 usasse o host 2 como um gateway para o host remoto 3. Eu vasculhei a Web procurando uma solução, mas não parece funcionar para mim. O software cliente VPN é o ike (shrewSoft VPN) que importa.

------ local network -------
host 1 - eth0 - 192.168.0.20 (hostname: fred)
host 2 - eth0 - 192.168.0.95 (hostname: toronto)
         tap0 - 172.16.1.20  (VPN tunnel)

----- remote network -------
host 3 - eth0 - 10.1.28.200

.

[root(tip)@fred ~]# ip route; echo; ip addr;
10.1.28.200 via 192.168.0.95 dev eth0
172.16.0.0/24 via 192.168.0.254 dev eth0
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.20
169.254.0.0/16 dev eth0  scope link
default via 192.168.0.254 dev eth0

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether e0:69:95:c3:32:5b brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.20/24 brd 192.168.0.255 scope global eth0
    inet6 fe80::e269:95ff:fec3:325b/64 scope link
       valid_lft forever preferred_lft forever
3: sit0: <NOARP> mtu 1480 qdisc noop
    link/sit 0.0.0.0 brd 0.0.0.0

[root(prod1)@toronto ~]# ip route
149.135.71.84 via 192.168.0.254 dev eth0  proto static
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.95
169.254.0.0/16 dev eth0  scope link  metric 1002
default via 172.16.1.5 dev tap0  proto static
default via 192.168.0.254 dev eth0

.

[root(prod1)@toronto ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:0c:29:b7:c5:ce brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.95/24 brd 192.168.0.255 scope global eth0
    inet6 fe80::20c:29ff:feb7:c5ce/64 scope link
       valid_lft forever preferred_lft forever
8: tap0: <BROADCAST,UP,LOWER_UP> mtu 1380 qdisc pfifo_fast state UNKNOWN qlen 500
    link/ether 62:6b:37:53:c2:fb brd ff:ff:ff:ff:ff:ff
    inet 172.16.1.5/32 brd 172.16.1.5 scope global tap0
    inet6 fe80::606b:37ff:fe53:c2fb/64 scope link
       valid_lft forever preferred_lft forever

.

[root(prod1)@toronto ~]# iptables -vnL
Chain INPUT (policy ACCEPT 67983 packets, 14M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 2032 packets, 90240 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  tap0   eth0    0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  eth0   tap0    0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 52284 packets, 12M bytes)
 pkts bytes target     prot opt in     out     source               destination

.

[root(prod1)@toronto ~]# iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 1099 packets, 186K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 511 packets, 30765 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 MASQUERADE  all  --  *      tap0    0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 510 packets, 30705 bytes)
 pkts bytes target     prot opt in     out     source               destination
[root(prod1)@toronto ~]#

EDIT Eu também devo mencionar que eu permiti o encaminhamento de pacotes no linux

echo 1 > /proc/sys/net/ipv4/ip_forward

UPDATE 2 Eu percebi que estava digitando tap0 quando estava tap0. Eu fiz as alterações acima. Agora eu posso ver iptables -t nat -vnL mostrando os pacotes sendo processados, e tcpdump mostra todos eles, mas o tcpdump não os mostra voltando. Eu pensei que o MASQUERADE faz o SNAT / DNAT automaticamente por si só?