Description of problem:
Testing openswan net to net funcionality.
When all connections are encrypted, funcionality is all right. But if I want unencrypted connection on specific port and all other connections encrypted, the funcionlity is broken.. Encrypted connections are fine, but unencrypted connection on specific port doesn't work.

Version-Release number of selected component (if applicable):
openswan-2.6.32-6.el6

How reproducible:
always

Steps to Reproduce:

I have this test case net topology:
left subnet: 192.168.111.0/24
right subnet: 192.168.100.0/24
middle subnet: 192.168.50.0/24

                   GW-left                             GW-right
     192.168.111.179 | | 192.168.50.5 -----192.168.50.6 | | 192.168.100.212
	             /                ipsec               \
	            /                                      \
	           /                                        \
   192.168.111.81 | |                                       | | 192.168.100.226
     PC-left                                                         PC-right

On GW-left and GW-right I have this:
/etc/ipsec.secrets
: PSK "whatever"

 /etc/ipsec.conf
conn test
        left=192.168.50.5
        right=192.168.50.6
        leftsubnet=192.168.111.0/24
        rightsubnet=192.168.100.0/24
        auto=add
        authby=secret
        type=tunnel
        ike=aes256-md5
        phase2=esp

conn pass
        left=192.168.50.5
        right=192.168.50.6
        leftsubnet=192.168.111.0/24
        rightsubnet=192.168.100.0/24
        auto=add
        authby=secret
        type=passthrough
        ike=aes256-md5
        phase2=esp
        rightprotoport=tcp/30000

On both GW run
ip xfrm state flush
ip xfrm policy flush
service ipsec restart
ipsec auto --route pass
ipsec auto --route test

On PC-right run:
nc -l 192.168.100.226 30000
nc -l 192.168.100.226 20000

On PC-left run:
echo "Hi" | nc -v -w 30 192.168.100.226 30000
echo "Hi" | nc -v -w 30 192.168.100.226 20000
  
Actual results:
Connection on port 30000 fail (nc output is connection timeout)
Connection on port 20000 (or other) is all right and encrypted

Expected results:
Connection on port 30000 pass