VPN Host                                 LAN Service
IPs: 192.168.2.2, 10.0.0.1               192.168.2.1

Incoming Packet
src: 10.0.0.2 dst: 10.0.0.1:666
masqueraded to:
src: 192.168.2.2 dst: 192.168.2.1:666

                                         receives packet
                                         src: 192.168.2.2 dst: 192.168.2.1:666

                                         sends answer packet
                                         src: 192.168.2.1:666 dst: 192.168.2.2

Receives answer packet:
src: 192.168.2.1:666 dst: 192.168.2.2
de-masqueraded to
src: 10.0.0.1:666 dst: 10.0.0.2