Patent ID: 7131141

Claim:
A security gateway comprising: a first logical interface to a first network; a second logical interface to a second network; a physical interface to an untrusted network through which a logical connection can be established to hosts, including hosts in a protected network; and a processor that is configure to perform source network address translation (SNAT) on packets that arrive at the first logical interface which are destined to the second network or to a host coupled to the untrusted network that is outside the protected network, and to communicate the SNAT processed packets to their respective destinations, refuse to establish communication to a host on the first network for a device on the second network, perform SNAT on packets that arrive at the second logical interface and that are destined to a host on the untrusted network that is outside the protected network, and to communicate the SNAT-processed packets to their destination, and send via the untrusted network, by use of an IPSec tunnel, packets that arrive at the first logical interface and that are destined to the protected network.