Looking to exclude certain destinations from masquarade

[Bruce Ferrell <bferrell@xxxxxxxxxxxx>]

I am trying to establish an ipsec tunnel from a system that is also a 
snat router.  so far I seem to be able to have my masquerade or my vpn 
tunnel but not both.

the basic rules I'm using are these:

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state 
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


Any suggestions?