From owner-freebsd-pf@FreeBSD.ORG  Thu Jul 31 00:06:59 2014
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id CFA9515F
 for <freebsd-pf@freebsd.org>; Thu, 31 Jul 2014 00:06:59 +0000 (UTC)
Received: from mail-wg0-x22f.google.com (mail-wg0-x22f.google.com
 [IPv6:2a00:1450:400c:c00::22f])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 6BBA527D3
 for <freebsd-pf@freebsd.org>; Thu, 31 Jul 2014 00:06:59 +0000 (UTC)
Received: by mail-wg0-f47.google.com with SMTP id b13so1948280wgh.30
 for <freebsd-pf@freebsd.org>; Wed, 30 Jul 2014 17:06:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=from:content-type:content-transfer-encoding:subject:message-id:date
 :to:mime-version;
 bh=UVOqEFHiyuxDNa2Cqw8EgHidwDrc2nZ9RRj+nbXjxlA=;
 b=Jg52VtmoxHN3RuUxcg2K0eSJOKvVlBeengITC+DRX2iWmOxq3aDzhan4kiMjBji8HL
 I/GaMil6jwAaZAk5wWfeLkW82iuNV9p8up9yOxc0lEpnzrpz2rIckRWY/elQi6WRC3Da
 g3Gi2XZL81ZQyg+WBkz3i41pKb7NbiZIn8bwYK7LYdfEdlcsp1V8b8zBDR6lpbOguy9t
 7rQC3lDOwJG96BnaGwJ3PzgiEGj1k5oKHvNIk4iwb0XAm/FEAx1SgN8u5wLGqq/AEUM7
 EvlzErQmjNhXlq8Zi1ddiepvXKhSXjktFF/DcoBbNcr9lXdbZhmsU1E6ff+3BoOWoYOf
 hS0Q==
X-Received: by 10.194.202.165 with SMTP id kj5mr11438915wjc.50.1406765217742; 
 Wed, 30 Jul 2014 17:06:57 -0700 (PDT)
Received: from ?IPv6:2001:470:78f5:3:a192:284f:6da8:537?
 ([2001:470:78f5:3:a192:284f:6da8:537])
 by mx.google.com with ESMTPSA id gq4sm14741787wib.8.2014.07.30.17.06.56
 for <freebsd-pf@freebsd.org>
 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
 Wed, 30 Jul 2014 17:06:57 -0700 (PDT)
From: Sydney Meyer <syd.meyer@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: NAT IPSec Traffic with pf
Message-Id: <9B8D62A1-8377-4D27-8E1B-816E16C96E5F@gmail.com>
Date: Thu, 31 Jul 2014 02:06:55 +0200
To: freebsd-pf@freebsd.org
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
X-Mailer: Apple Mail (2.1878.6)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 31 Jul 2014 00:06:59 -0000

Got a reply in the forums from "junovitch":

"There is a bug in 10.0-RELEASE with how how the kernel is tagging the =
mbuf allocated with IPSEC packets as it gets tagged to skip firewalling. =
Hence PF can't NAT what it can't see. Short answer is you need to =
upgrade to 10.0-STABLE or use an older version of FreeBSD.

Long answers:
http://www.freebsd.org/cgi/query-pr.cgi?pr=3D185876 - The PR with the =
technical details.
https://forums.freebsd.org/viewtopic.php?f=3D7&t=3D45691 - Same issue =
and the troubleshooting that helped find it."

Upgrading to 10 STABLE fixed the issue.

Cheers,
S.=