probably a lot more complicated than your setup with ipsec, but should be doable