15.38. Why can't my IPsec VPN clients connect from behind NAT?

That's because FreeBSD doesn't support NAT-T by default. It is an option on the mobile IPsec page, however.