IPsec work and question about Linux routing?

//
// IPsec test configuration
//

AddressInfo(
	// The "inner net" protected by the IPsec, and address of this host there
	net 10.0.0.1/8,
	// Address of the remote security gateway
	sgw 192.168.0.15,
	// My outer source address (I wish I didn't need to specify this)
	me 192.168.0.14)

host :: KernelTun(net);


t1 :: IPsecAdapter(ESP,AUTH 2,ENCR 12);
s1 :: IPsecSelector(REMOTE net);
a1 :: IPsecPolicyAction(TUNNEL sgw me, PROPOSAL t1);

// IPsec([SELECTOR, ACTION]*...) - the RFC-4301 SPD and SAD component
//
// 2 input ports:
//
// [0]IPsec - outbound IPv4/IPv6 packets. Check the packet
// and route the packet to output port based on the policy
// If the port is for IPsec transform, annotate packet with
// the security association (SA).
//
// [1]IPsec - policy check for inbound IPv4/IPv6 packets.
// Check the packet and applied IPsec against the policy.
// If the packet has IPsec, the tranformation/decapsulation
// must have been done and the packet annotated with the
// security association (SA) -- see IPsecInbound element.

// 4..N output ports:
//
// IPsec[0] - BYPASS outbound packets from input port 0
// (packets that don't require IPsec).
//
// IPsec[1] - inbound packets from input port 1 which PASS
// the policy checks.
//
// IPsec[2] - inbound or outbound packets that fail policy
// check (DISCARD)
//
// IPsec[3] - outbound packets which triggered ACQUIRE
// processing that was not completed -- complete security
// association not available. The packet is annotated with
// the LARVAL outbound SA, that triggered ACQUIRE.
//
// IPsec[4..N-1] - the supported outbound IPsec transform
// pipelines. The first element in chain must be derived
// from IPsecTransform, which provides the transform/proposal
// information for the IPsec element (IPsecAdapter is one, and
// provides adaptation of security association to the "old"
// SADataTuple, which is used by existing old elements).

host ->
     // using "fixed" policy with only one selector to
     // action (s1 -> a1)
     [0] ipsec::IPsec(SELECTOR s1, ACTION a1);

ipsec[0] -> host;	// BYPASS
ipsec[1] -> host;	// PASS
ipsec[2] -> Discard;	// DISCARD
ipsec[3] -> Discard;	// ACQUIRE
// For now, only one example pipeline using old
// element for "HMAC-SHA + AES" (only for IPv4)
ipsec[4]
    -> t1
    -> IPsecESPEncap()
    -> IPsecAuthHMACSHA1(0)
    -> IPsecAES(1)
    -> IPsecEncap(esp)
    -> FixIPSrc(me)
    -> host;


// IPsecInbound - the IPsec frontend for inbound IPv4/IPv6 packets.
//
// 1 input port:
//
// [0]IPsecInbound - check if the packet requires IPsec processing
// (has ESP or AH) and route to appropriate output port.
//
// 1..N ouput ports:
//
// [0]IPsecInbound - plain inbound IP packets, not having IPsec
// headers -- annotation for security association is NULL.
//
// [1..N-1] - the supported inbound IPsec transform pipelines.
// The first element in chain must be derived from IPsecTransform,
// which provides the transform/proposal information for the IPsec
// element (IPsecAdapter is one, and provides adaptation of security
// association to the "old" SADataTuple, which is used by existing
// old elements).
// The packet is passed to output as is (no decapsulation in IPsecInbound),
// but the annotation for the inbound security association determined
// by the AH or ESP is set.

FromDevice(eth1)
	-> Strip(14)
	-> inbound :: IPsecInbound(ipsec);

inbound[0]
	-> [1] ipsec;
// For now, only one example pipeline using old
// element for "HMAC-SHA + AES" (only for IPv4)
inbound[1]
	-> [1]t1[1]
	-> StripIPHeader()
	-> IPsecAES(0)
	-> IPsecAuthHMACSHA1(1)
	-> IPsecESPUnencap()
	-> CheckIPHeader()
	-> [1] ipsec;

// IPsecKM(IPSEC, [SELECTOR, SA]*...)
//
// Simple fixed manual key provider for processing the
// ACQUIRE generated by the IPsec. The ACQUIRE matching
// the sgw (selector vpn) is served by the provided fixed
// key data (sa) resulting one inbound and one outbound
// SA.
//
// IPsecKM would be the base class for elements that
// implement real key management like IKE, either
// directly within Click or provide a adapter to
// external key manager.

vpn :: IPsecSelector(REMOTE sgw);
sa :: IPsecSAData(
   SPI 1000,
   PROTO 3,
   ENCR 12 \<0123456789abcdef0123456789abcdef>,
   AUTH 2  \<0123456789abcdef0123456789abcdef>);
km::IPsecKM(ipsec, SELECTOR vpn, SA sa);