On Sat, 12 Sep 2009, Maverick wrote: > :POSTROUTING ACCEPT [0:0] > > -A POSTROUTING -o eth3 -j MASQUERADE > > -A POSTROUTING -o ipsec0 -j MASQUERADE You mean -j ACCEPT? You can't NAT packets meant for ipsec