The router moon sets up a connection to gateway sun in order to reach the subnet hidden behind sun. The gateway sun assigns a virtual IP address to router moon. A special updown script on moon specified by leftupdown=/etc/nat_updown dynamically inserts a source NAT rule which maps the IP address of client alice to the virtual IP of moon. This allows alice to access client bob via the established IPsec tunnel.