Multiple networks through one VPN connection

[Kenneth Ingham <ingham_(_at_)_i-pi_(_dot_)_com>]

I need to access two networks, both directly attached to my OpenBSD
firewall router.  I have a VPN running wich works to one of those
networks (192.168.4.0/23) and I want to make is so that the tunnel is
used for both.

What I would like is to simply tell isakmpd about the other network, say
like:

[Net-South]
ID-type=                IPV4_ADDR_SUBNET
Network=                192.168.4.0
Netmask=                255.255.254.0
ID-type=                IPV4_ADDR_SUBNET
Network=                10.0.4.0
Netmask=                255.255.255.0

This approach does not appear to work; not surprisingly, I get a
duplicate tag error.  The error is the same if I go back one level to
the <Phase1-ID> tag and try adding two Remote-IDs.

I also tried simply adding a route:

# route add 10.0.8.0/24 192.168.8.3
writing to routing socket: No such process
add net 10.0.8.0: gateway 192.168.8.3: not in table

where 192.168.8.3 is the inside address of the router on the remote
side, and there is currently an established VPN connection with a route
table entry for 192.168.8.0/23.

Any other suggestions?

Kenneth