H1-----SG1=====R1=====INTERNET======Rn=====SG2------H2H1 and/or H2 are non-routable addresses (RFC1918) which have been masqueraded by SG1 and/or SG2, respectively, preventing incoming internet access, allowing outgoing internet access while providing Classical VPN functionality.