Did you patch the kernel using NAT-T patch ? And did you turn on the nat_traversal ? It happens to my system too where I have nat-t patch, but nat_traversal is disabled (default) in freeswan configuration, then I put in a rule like this :- iptables -t nat -I PREROUTING -p esp When I list the rule, I can't see any packet going thru' it. Regards.