(racoon 783) Ipsec connection from gateway itself over vpn

Hello everyone,
I'm not sure whether to place my question here or in the shorewall 
mailing list.
I have created an ipsec connection with racoon in tunnel mode to another 
gateway to connect one subnet on each side to each other. This works 
fine. Only the ipsec gateway itself can't send packages to the opposite 
subnet.
Shorewall is configured according to:

http://www.shorewall.net/IPSEC-2.6.html

Is there a second "roadwarrior" tunnel to be defined just only for the 
gateway?
I have patched the kernel linux 2.8.1 and iptables-1.2.11 with the 
"policy match" patch, but the "IPSEC-Netfilter" patches (mentioned in: 
http://www.shorewall.net/IPSEC.htm) where rejected by patch-o-matic-ng 
from 2004/09/21. How are they applied?

Kay