Basically, this is what I want:

There are several branch offices and one headquarter. Each branch office and headquarter is configured as Intranet w/ private network addresses. There is a firewall for each Intranet, configured w/ IPTables. Intranet LAN to Intranet LAN is configured as site-to-site VPN, i.e., only traffic between pairs of firewall machines are VPNed.

So, for Intranet users to access Internet, we need to have NAT in IPTables.

I have not worked on a configuration, just wondered, will this NAT conflict with this site-2-site VPN? Users in branch offices need to access some internal servers in headquarter's LAN.

This seems to be a silly question, considering VPN is used to connect distributed offices (private network) via WAN. But I didn't figure out how both works together. Hope to hear some instructions here.

Thanks!

I read an article on IpCop's design that explained how IpCop solved the problem, but I haven't been able to locate the article again. In short, the VPN and iptables/NAT have to "straddle" one-another. This way the VPN's can connect to one another without hassling with NAT issues, but you still get NAT functionality. If I find the article I'll post it.