Пакеты не попадают в IPSec (racoon)

root@gateway:/etc/racoon# cat racoon.conf 

log debug2;
path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";

listen {
	isakmp 11.22.33.205 [500];
}

remote 55.66.77.88 [500] {
	doi ipsec_doi;
	situation identity_only;
	nonce_size 16;
	exchange_mode main;
	lifetime time 3600 sec;
	initial_contact on;
	passive on;
	proposal_check obey;
	generate_policy off;
	proposal {
		encryption_algorithm des;
		hash_algorithm sha1;
		authentication_method pre_shared_key;
		dh_group 1;
	}
}

sainfo anonymous {
	pfs_group 1;
	lifetime time 3600 sec;
	encryption_algorithm des;
	authentication_algorithm hmac_md5;
	compression_algorithm deflate;
}

root@gateway:/etc/racoon# cat ipsec.conf 
#!/usr/sbin/setkey -f

## Flush the SAD and SPD
#
flush;
spdflush;

## Some sample SPDs for use racoon
#
spdadd 192.168.3.0/24 192.168.1.0/24 any -P in ipsec esp/tunnel/55.66.77.88-11.22.33.205/require;
spdadd 192.168.1.0/24 192.168.3.0/24 any -P out ipsec esp/tunnel/11.22.33.205-55.66.77.88/require;

root@gateway:/etc/racoon# setkey -D
11.22.33.205 55.66.77.88 
	esp mode=tunnel spi=2919576224(0xae0532a0) reqid=0(0x00000000)
	E: des-cbc  c92d9a4d fc80ddf7
	A: hmac-md5  781dba62 d5ec1c9c 840c8a48 bd72f899
	seq=0x00000000 replay=4 flags=0x00000000 state=mature 
	created: Jun  2 13:26:53 2013	current: Jun  2 13:35:41 2013
	diff: 528(s)	hard: 3600(s)	soft: 2880(s)
	last: Jun  2 13:26:54 2013	hard: 0(s)	soft: 0(s)
	current: 9323(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 89	hard: 0	soft: 0
	sadb_seq=1 pid=2782 refcnt=0
55.66.77.88 11.22.33.205
	esp mode=tunnel spi=49129434(0x02eda7da) reqid=0(0x00000000)
	E: des-cbc  6acd7c3c efd1fed1
	A: hmac-md5  a4dd2f17 499571a5 8e437493 6b5d72ab
	seq=0x00000000 replay=4 flags=0x00000000 state=mature 
	created: Jun  2 13:26:53 2013	current: Jun  2 13:35:41 2013
	diff: 528(s)	hard: 3600(s)	soft: 2880(s)
	last: Jun  2 13:26:54 2013	hard: 0(s)	soft: 0(s)
	current: 87296(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 187	hard: 0	soft: 0
	sadb_seq=0 pid=2782 refcnt=0

root@gateway:/etc/racoon# setkey -DP
(per-socket policy) 
	out(socket) none
	created: Jun  2 13:23:26 2013  lastused: Jun  2 13:26:53 2013
	lifetime: 0(s) validtime: 0(s)
	spid=68 seq=1 pid=2784
	refcnt=1
(per-socket policy) 
	in(socket) none
	created: Jun  2 13:23:26 2013  lastused: Jun  2 13:26:53 2013
	lifetime: 0(s) validtime: 0(s)
	spid=59 seq=2 pid=2784
	refcnt=1
192.168.1.0/24[any] 192.168.3.0/24[any] 255
	out prio def ipsec
	esp/tunnel/11.22.33.205-55.66.77.88/require
	created: Jun  2 13:19:47 2013  lastused: Jun  2 13:37:13 2013
	lifetime: 0(s) validtime: 0(s)
	spid=49 seq=3 pid=2784
	refcnt=6
192.168.3.0/24[any] 192.168.1.0/24[any] 255
	fwd prio def ipsec
	esp/tunnel/55.66.77.88-11.22.33.205/require
	created: Jun  2 13:19:47 2013  lastused: Jun  2 13:37:22 2013
	lifetime: 0(s) validtime: 0(s)
	spid=42 seq=4 pid=2784
	refcnt=7
192.168.3.0/24[any] 192.168.1.0/24[any] 255
	in prio def ipsec
	esp/tunnel/55.66.77.88-11.22.33.205/require
	created: Jun  2 13:19:47 2013  lastused:                     
	lifetime: 0(s) validtime: 0(s)
	spid=32 seq=0 pid=2784
	refcnt=1

sysadmin@sysadmin:~$ traceroute 192.168.3.1
traceroute to 192.168.3.1 (192.168.3.1), 30 hops max, 60 byte packets
 1  gateway.localnet.firm (192.168.1.242)  0.145 ms  0.132 ms  0.129 ms
 2  noname.slan.ru (11.22.33.1)  21.984 ms  25.248 ms  33.473 ms
 3  dyn.dialup.l4-c2.provider.su (11.22.33.113)  36.820 ms  41.766 ms  45.075 ms
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  *^C

root@gateway:/etc/racoon# ip route
default dev eth2  scope link 
10.1.1.0/24 dev eth1  proto kernel  scope link  src 10.1.1.2 
11.22.33.0/24 dev eth2  proto kernel  scope link  src 11.22.33.205 
192.168.1.0/24 dev eth1  proto kernel  scope link  src 192.168.1.242