It is possible.
You would need:
- Ports opened to pass VPN traffic through to the Debian boxes
- IPSEC configuration on each machine
- IPSEC userspace tools installed (ipsec-tools (and a kernel with it supported, so > 2.5.7))
- A guide like http://lartc.org/howto/lartc.ipsec.html
- Lots of fiddling with config files
Then, on your router/default gateway, add static routes for the remote subnets pointing to the Debian boxes.
The configuration isn't that bad, but if you've never dealt with IPSEC VPNs before it may be a confusing mess (but then, it is Linux, so everything is ;) )
On the last (and only) server I got it working on, there were six files involved, which I include below, in a censored fashion. Where I've put *local_ip* was the ip address of the local server, and where I've put *remote_ip* was the ip address of the remote server, and this config was for secure communication between two machines on the same network, so the config isn't going to be right for you with NAT and multiple machines involved.
You will need to mirror the config on either side (so, swapping the local_ip and remote_ip bits on one server), and also find where you need to put public IPs to get it working over the internet.
Anyway, if you want to get it working, be prepared to spend some hours faffing with it, because it might well take that. VPNs are not really click and drag, unless you buy expensive firewall kit.
path include "/etc/racoon";
path pre_shared_key "/etc/racoon/psk";
path certificate "/etc/racoon/certs";
# log debug2;
#Add the policy
#This policy applies to inbound traffic from remote
spdadd remote_ip/32 local_ip/32 any -P in ipsec esp/transport//require;
spdadd remote_ip/32 local_ip/32 any -P in ipsec ah/transport//require;
#This policy applies to outbound traffic to remote
spdadd local_ip/32 remote_ip/32 any -P out ipsec esp/transport//require;
spdadd local_ip/32 remote_ip/32 any -P out ipsec ah/transport//require;
my_identifier address local_ip;
lifetime time 8 hours;
sainfo address local_ip any address remote_ip any
sainfo address remote_ip any address local_ip any