diff -urN openswan-2.4.13-orig/linux/net/ipsec/ipsec_rcv.c openswan-2.4.13/linux/net/ipsec/ipsec_rcv.c
--- openswan-2.4.13-orig/linux/net/ipsec/ipsec_rcv.c	2010-08-23 15:13:40.000000000 +0800
+++ openswan-2.4.13/linux/net/ipsec/ipsec_rcv.c	2010-08-23 15:57:45.000000000 +0800
@@ -1622,6 +1622,7 @@
 			subnettoa(ipsp->ips_flow_d.u.v4.sin_addr,
 				ipsp->ips_mask_d.u.v4.sin_addr,
 				0, dflow_txt, sizeof(dflow_txt));
+			#if 0
 			KLIPS_PRINT(debug_rcv,
 				    "klips_debug:ipsec_rcv: "
 				    "SA:%s, inner tunnel policy [%s -> %s] does not agree with pkt contents [%s -> %s].\n",
@@ -1634,6 +1635,15 @@
 				irs->stats->rx_dropped++;
 			}
 			return IPSEC_RCV_REALLYBAD;
+			#endif
+			KLIPS_PRINT(debug_rcv,
+				    "klips_debug:ipsec_rcv: "
+				    "SA:%s, inner tunnel policy [%s -> %s] does not agree with pkt contents [%s -> %s].(more routes !!!)\n",
+				    irs->sa_len ? irs->sa : " (error)",
+				    sflow_txt,
+				    dflow_txt,
+				    irs->ipsaddr_txt,
+				    irs->ipdaddr_txt);
 		}
 #ifdef CONFIG_NETFILTER
 		skb->nfmark = (skb->nfmark & (~(IPsecSAref2NFmark(IPSEC_SA_REF_TABLE_MASK))))
diff -urN openswan-2.4.13-orig/programs/_updown/_updown.in openswan-2.4.13/programs/_updown/_updown.in
--- openswan-2.4.13-orig/programs/_updown/_updown.in	2006-02-21 06:57:28.000000000 +0800
+++ openswan-2.4.13/programs/_updown/_updown.in	2010-09-01 11:16:27.000000000 +0800
@@ -394,7 +394,64 @@
 	fi
 	return $st
 }
- 
+
+doStaticRoute() {
+	local Tname
+	local said
+	local del_route=
+	local del_eroute=
+	local wan_dev=
+	for ipn in 0 1; do
+		Tname=$(uci -c /etc/config/grocx/ -q get ipsec.$ipn.name | awk '{print "T"$1}')
+		wan_dev=$(uci -p /var/state/ -q get network.wan.ifname)
+		if [ "$Tname" == "$PLUTO_CONNECTION" ]; then
+			case "$1" in
+			add)
+				said=$(ipsec spi | grep "$PLUTO_PEER" | grep "IPIP: dir=out" | awk '{print $1}')
+				ipsec eroute --add --eraf inet --src 0.0.0.0/0 --dst $PLUTO_PEER_CLIENT --said $said
+				[ -n "$wan_dev" ] && {
+					iptables -t nat -A zone_wan_nat -s $PLUTO_PEER_CLIENT -o $wan_dev -j MASQUERADE
+				}
+				if [ $(uci -c /etc/config/grocx/ -q get ipsec.$ipn.def_route) == "1"  ]; then
+					ipsec eroute --del --eraf inet --src $PLUTO_MY_CLIENT --dst 0.0.0.0/0
+					ipsec eroute --add --eraf inet --src $PLUTO_MY_CLIENT --dst 0.0.0.0/0  --said $said
+					route del default
+					route add default dev $PLUTO_INTERFACE
+					flush-ipconntrack &
+				fi
+				
+				/sbin/ipsec_static_route add $said $PLUTO_PEER $PLUTO_MY_CLIENT $PLUTO_PEER_CLIENT $PLUTO_CONNECTION
+			;;
+			del)
+				ipsec eroute --del --eraf inet --src 0.0.0.0/0 --dst $PLUTO_PEER_CLIENT
+				[ -n "$wan_dev" ] && {
+					iptables -t nat -D zone_wan_nat -s $PLUTO_PEER_CLIENT -o $wan_dev -j MASQUERADE
+				}
+
+				[ $(ipsec eroute | grep " -> 0.0.0.0/0" | grep "$PLUTO_PEER" > /dev/null 2>&1 && echo 1 || echo 0) == "1" ] && {
+					del_eroute="1"
+					[ $(route | grep "default" | grep ipsec > /dev/null 2>&1 && echo 1 || echo 0) == "1" ] && {
+						del_route="1"
+					}
+				}
+				
+				[ "$del_route" == "1" ] && {
+					route del default
+					restore_default_route
+					flush-ipconntrack &
+				}
+				
+				[ "$del_eroute" == "1" ] && {
+					ipsec eroute --del --eraf inet --src $PLUTO_MY_CLIENT --dst 0.0.0.0/0
+				}
+				
+				/sbin/ipsec_static_route del tun0x0000 $PLUTO_PEER $PLUTO_MY_CLIENT $PLUTO_PEER_CLIENT $PLUTO_CONNECTION
+			;;
+			esac
+			break
+		fi
+	done
+} 
 
 # the big choice
 case "$PLUTO_VERB:$1" in
@@ -459,11 +516,13 @@
 up-client:)
 	# connection to my client subnet coming up
 	uprule
+	doStaticRoute add
 	# If you are doing a custom version, firewall commands go here.
 	;;
 down-client:)
 	# connection to my client subnet going down
 	downrule
+	doStaticRoute del
 	# If you are doing a custom version, firewall commands go here.
 	;;
 up-client:ipfwadm)
diff -urN openswan-2.4.13-orig/programs/pluto/kernel.c openswan-2.4.13/programs/pluto/kernel.c
--- openswan-2.4.13-orig/programs/pluto/kernel.c	2010-08-25 19:18:01.000000000 +0800
+++ openswan-2.4.13/programs/pluto/kernel.c	2010-08-25 19:14:42.000000000 +0800
@@ -741,7 +741,7 @@
                     , opname, mybuf, sport, transport_proto, peerbuf, dport
                     , text_said);
         });
-
+	
     return kernel_ops->raw_eroute(this_host, this_client
                                   , that_host, that_client
                                   , spi, proto
@@ -905,7 +905,10 @@
 , unsigned int op, const char *opname)
 {
     const ip_address *peer = &sr->that.host_addr;
-    char buf2[256];
+    char buf2[256],buf3[256];;
+	char mybuf[SUBNETTOT_BUF], peerbuf[SUBNETTOT_BUF];
+	char peerip[ADDRTOT_BUF];
+	char text_said[SATOT_BUF];
 
     snprintf(buf2, sizeof(buf2)
              , "eroute_connection %s", opname);
@@ -913,6 +916,20 @@
     if (proto == SA_INT)
         peer = aftoinfo(addrtypeof(peer))->any;
 
+	if(!strcmp(opname,"replace")){
+		DBG_log("%s eroute %s --> %s =>  %s  %s(eroute_connection)"
+                    , opname, mybuf, peerbuf, text_said,peerip);	
+			
+		subnettot(&sr->this.client, 0, mybuf, sizeof(mybuf));
+		subnettot(&sr->that.client, 0, peerbuf, sizeof(peerbuf));
+		addrtot(peer, 0, peerip, sizeof(peerip));
+		set_text_said(text_said, peer, spi, proto);
+		
+		snprintf(buf2,sizeof(buf2),
+			"/sbin/ipsec_static_route %s %s %s %s %s",opname,text_said,peerip,mybuf,peerbuf);
+		system(buf2);
+	}
+	
     return raw_eroute(&sr->this.host_addr, &sr->this.client
                       , peer
                       , &sr->that.client
