IPSEC VPN gateway/NAT using Racoon and Setkey

Keep an eye on mode…

spdadd 10.0.2.0/24 10.0.1.0/24 any -P out ipsec esp/tunnel/172.16.0.2-172.16.0.1/require;
spdadd 10.0.1.0/24 10.0.2.0/24 any -P in ipsec esp/tunnel/172.16.0.1-172.16.0.2/require;

… use tunnel not transport. sigh…