Assuming that ESP is selected instead of AH, NocturnalPing has it correct. It should be noted that interesting traffic (traffic that is encrypted within the VPN tunnel) or the clients sending the interesting traffic will not know about any part of the network that is routing the encrypted...