Caught at one hundred and twenty metres per second

Today I discovered a very useful and nearly undocumented Openswan configuration parameter, which goes by the name of leftsourceip (and symmetrically rightsourceip). What it does is telling the Linux Openswan VPN gateway what address to send traffic from, which it generates itself, and is destined for the other side of the VPN connection. Apparently there are some caveats when using the KLIPS IPsec stack, but it works great when using NETKEY. Details available in the thread up to and following this message on the Openswan Users mailinglist.

The immediate advantage of using leftsourceip is that you can just reach machines on the far end of the connection, from either gateway where you've set it, without having to specify source interface or address on the internal network.

There's already a patch in the Openswan BTS; hopefully it will be integrated soon.