$ ipsec version
Linux Openswan U2.4.12/K2.6.27-7-generic (netkey)
See `ipsec --copyright' for copyright information.

conn forti
        leftxauthclient=yes
        rightxauthserver=yes
        left=%defaultroute
        leftsourceip=192.168.1.7
        leftnexthop=192.168.1.1
        leftsubnet=192.168.1.0/24
        right=x.x.x.x
        ike=3des-sha1
        ikelifetime=28800s
        esp=3des-md5
        keylife=3600s
        keyexchange=ike
        authby=secret
        compress=yes
        auto=add

192.168.1.7 x.x.x.x : PSK "<preshared_keys>"

$ sudo ipsec verify
Checking your system to see if IPsec got installed and started correctly:
Version check and ipsec on-path                                 [OK]
Linux Openswan U2.4.12/K2.6.27-7-generic (netkey)
Checking for IPsec support in kernel                            [OK]
NETKEY detected, testing for disabled ICMP send_wwwects       [OK]
NETKEY detected, testing for disabled ICMP accept_wwwects     [OK]
Checking for RSA private key (/etc/ipsec.d/hostkey.secrets)     [OK]
Checking that pluto is running                                  [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing                                  [N/A]
Checking for 'ip' command                                       [OK]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

$ traceroute xxxx
traceroute to xxxx, 30 hops max, 40 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
16  * * *
17  * * *
18  * * *
19  * * *
20  * * *
21  * * *
22  * * *
23  * * *
24  * * *
25  * * *
26  * * *
27  * * *
28  * * *
29  * * *
30  * * *

cat nat-t.patch 
if [ -f /usr/src/linux/Makefile ]; then \
		make nattpatch2.6; \
	else	echo "Cannot determine Linux kernel version. Perhaps you need to set KERNELSRC? (eg: export KERNELSRC=/usr/src/linux-`uname -r`/)"; exit 1; \
	fi;
make[1]: Entering directory `/usr/src/openswan-2.6.20'
packaging/utils/nattpatch 2.6
--- /dev/null   Tue Mar 11 13:02:56 2003
+++ nat-t/include/net/xfrmudp.h     Mon Feb  9 13:51:03 2004
@@ -0,0 +1,11 @@
+/*
+ * pointer to function for type that xfrm4_input wants, to permit
+ * decoupling of XFRM from udp.c
+ */
+#define HAVE_XFRM4_UDP_REGISTER
+
+typedef int (*xfrm4_rcv_encap_t)(struct sk_buff *skb, __u16 encap_type);
+extern int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
+				      , xfrm4_rcv_encap_t *oldfunc);
+extern int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func
+				      , xfrm4_rcv_encap_t oldfunc);
--- /distros/kernel/linux-2.6.11.2/net/ipv4/Kconfig	2005-03-09 03:12:33.000000000 -0500
+++ swan26/net/ipv4/Kconfig	2005-04-04 18:46:13.000000000 -0400
@@ -351,2 +351,8 @@
 
+config IPSEC_NAT_TRAVERSAL
+	bool "IPSEC NAT-Traversal (KLIPS compatible)"
+	depends on INET
+	---help---
+          Includes support for RFC3947/RFC3948 NAT-Traversal of ESP over UDP.
+
 config IP_TCPDIAG
--- plain26/net/ipv4/udp.c.orig	2006-12-28 20:53:17.000000000 -0500
+++ plain26/net/ipv4/udp.c	2007-05-11 10:22:50.000000000 -0400
@@ -108,6 +108,7 @@
 #include <net/inet_common.h>
 #include <net/checksum.h>
 #include <net/xfrm.h>
+#include <net/xfrmudp.h>
 
 /*
  *	Snmp MIB for the UDP layer
@@ -881,6 +882,31 @@
 	sk_common_release(sk);
 }
 
+#if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
+
+static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
+int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
+			       , xfrm4_rcv_encap_t *oldfunc)
+{
+  if(oldfunc != NULL) {
+    *oldfunc = xfrm4_rcv_encap_func;
+  }
+
+  xfrm4_rcv_encap_func = func;
+  return 0;
+}
+
+int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func, xfrm4_rcv_encap_t old)
+{
+  if(xfrm4_rcv_encap_func != func)
+    return -1;
+
+  xfrm4_rcv_encap_func = old;
+  return 0;
+}
+#endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
+
+
 /* return:
  * 	1  if the the UDP system should process it
  *	0  if we should drop this packet
@@ -888,9 +914,9 @@
  */
 static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
 {
-#ifndef CONFIG_XFRM
+#if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
 	return 1; 
-#else
+#else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */
 	struct udp_sock *up = udp_sk(sk);
   	struct udphdr *uh;
 	struct iphdr *iph;
@@ -1018,10 +1044,27 @@
 			return 0;
 		}
 		if (ret < 0) {
-			/* process the ESP packet */
-			ret = xfrm4_rcv_encap(skb, up->encap_type);
-			UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
-			return -ret;
+ 			if(xfrm4_rcv_encap_func != NULL)
+				ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
+	
+			switch(ret) {
+			case 1:
+				/* FALLTHROUGH to send-up */;
+				break;
+				
+			case 0:
+                                /* PROCESSED, free it */
+				UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
+				return 0;
+				
+			case -1:
+				/* PACKET wasn't for _func, or no func, pass it
+				 * to stock function
+				 */
+				ret = xfrm4_rcv_encap(skb, up->encap_type);
+				UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
+				return -ret;
+			}
 		}
 		/* FALLTHROUGH -- it's a UDP Packet */
 	}
@@ -1110,7 +1153,6 @@
 /*
  *	All we need to do is get the socket, and then do a checksum. 
  */
- 
 int udp_rcv(struct sk_buff *skb)
 {
   	struct sock *sk;
@@ -1599,3 +1641,9 @@
 EXPORT_SYMBOL(udp_proc_register);
 EXPORT_SYMBOL(udp_proc_unregister);
 #endif
+
+#if defined(CONFIG_IPSEC_NAT_TRAVERSAL)
+EXPORT_SYMBOL(udp4_register_esp_rcvencap);
+EXPORT_SYMBOL(udp4_unregister_esp_rcvencap);
+#endif
+
make[1]: Leaving directory `/usr/src/openswan-2.6.20'

cd ../linux
cat ../nat-t.patch | patch -p1
patching file include/net/xfrmudp.h
patching file net/ipv4/Kconfig
Hunk #1 succeeded at 351 with fuzz 1.
patching file net/ipv4/udp.c
Hunk #1 FAILED at 108.
Hunk #2 FAILED at 882.
Hunk #3 FAILED at 914.
Hunk #4 FAILED at 1044.
Hunk #5 FAILED at 1153.
Hunk #6 succeeded at 1789 (offset 148 lines).
5 out of 6 hunks FAILED -- saving rejects to file net/ipv4/udp.c.rej

***************
*** 108,113 ****
  #include <net/inet_common.h>
  #include <net/checksum.h>
  #include <net/xfrm.h>
  
  /*
   *	Snmp MIB for the UDP layer
--- 108,114 ----
  #include <net/inet_common.h>
  #include <net/checksum.h>
  #include <net/xfrm.h>
+ #include <net/xfrmudp.h>
  
  /*
   *	Snmp MIB for the UDP layer
***************
*** 881,886 ****
  	sk_common_release(sk);
  }
  
  /* return:
   * 	1  if the the UDP system should process it
   *	0  if we should drop this packet
--- 882,912 ----
  	sk_common_release(sk);
  }
  
+ #if defined(CONFIG_XFRM) || defined(CONFIG_IPSEC_NAT_TRAVERSAL)
+ 
+ static xfrm4_rcv_encap_t xfrm4_rcv_encap_func = NULL;
+ int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
+ 			       , xfrm4_rcv_encap_t *oldfunc)
+ {
+   if(oldfunc != NULL) {
+     *oldfunc = xfrm4_rcv_encap_func;
+   }
+ 
+   xfrm4_rcv_encap_func = func;
+   return 0;
+ }
+ 
+ int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func, xfrm4_rcv_encap_t old)
+ {
+   if(xfrm4_rcv_encap_func != func)
+     return -1;
+ 
+   xfrm4_rcv_encap_func = old;
+   return 0;
+ }
+ #endif /* CONFIG_XFRM_MODULE || CONFIG_IPSEC_NAT_TRAVERSAL */
+ 
+ 
  /* return:
   * 	1  if the the UDP system should process it
   *	0  if we should drop this packet
***************
*** 888,896 ****
   */
  static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
  {
- #ifndef CONFIG_XFRM
  	return 1; 
- #else
  	struct udp_sock *up = udp_sk(sk);
    	struct udphdr *uh;
  	struct iphdr *iph;
--- 914,922 ----
   */
  static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
  {
+ #if !defined(CONFIG_XFRM) && !defined(CONFIG_IPSEC_NAT_TRAVERSAL)
  	return 1; 
+ #else /* either CONFIG_XFRM or CONFIG_IPSEC_NAT_TRAVERSAL */
  	struct udp_sock *up = udp_sk(sk);
    	struct udphdr *uh;
  	struct iphdr *iph;
***************
*** 1018,1027 ****
  			return 0;
  		}
  		if (ret < 0) {
- 			/* process the ESP packet */
- 			ret = xfrm4_rcv_encap(skb, up->encap_type);
- 			UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
- 			return -ret;
  		}
  		/* FALLTHROUGH -- it's a UDP Packet */
  	}
--- 1044,1070 ----
  			return 0;
  		}
  		if (ret < 0) {
+  			if(xfrm4_rcv_encap_func != NULL)
+ 				ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);
+ 	
+ 			switch(ret) {
+ 			case 1:
+ 				/* FALLTHROUGH to send-up */;
+ 				break;
+ 				
+ 			case 0:
+                                 /* PROCESSED, free it */
+ 				UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
+ 				return 0;
+ 				
+ 			case -1:
+ 				/* PACKET wasn't for _func, or no func, pass it
+ 				 * to stock function
+ 				 */
+ 				ret = xfrm4_rcv_encap(skb, up->encap_type);
+ 				UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
+ 				return -ret;
+ 			}
  		}
  		/* FALLTHROUGH -- it's a UDP Packet */
  	}
***************
*** 1110,1116 ****
  /*
   *	All we need to do is get the socket, and then do a checksum. 
   */
-  
  int udp_rcv(struct sk_buff *skb)
  {
    	struct sock *sk;
--- 1153,1158 ----
  /*
   *	All we need to do is get the socket, and then do a checksum. 
   */
  int udp_rcv(struct sk_buff *skb)
  {
    	struct sock *sk;