routing anomaly?

I am running a system (2.4.24) with Advanced Router etc turned on
running IPSec.

I found an issue in that packets leaving the local system
get routed via the eth1 interface rather than the ipsec interface.


eth0 Link encap:Ethernet HWaddr 00:04:75:E9:36:0B
inet addr:192.168.64.252 Bcast:192.168.127.255 Mask:255.255.192.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:14323140 errors:315 dropped:0 overruns:210 frame:325
TX packets:14933012 errors:0 dropped:0 overruns:0 carrier:142
collisions:37335 txqueuelen:1000
RX bytes:3353944437 (3198.5 Mb) TX bytes:2320103685 (2212.6 Mb)
Interrupt:26 Base address:0x2400

eth1 Link encap:Ethernet HWaddr 00:50:8B:9A:AD:3E
inet addr:1.2.3.146 Bcast:1.2.3.159 Mask:255.255.255.240
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX
packets:8490202 errors:0 dropped:0 overruns:0 frame:0 TX
packets:7668392 errors:2 dropped:0 overruns:0 carrier:2
collisions:0 txqueuelen:1000
RX bytes:1853899906 (1768.0 Mb) TX bytes:1888822332 (1801.3 Mb)
Interrupt:23 Base address:0x1c00 Memory:b1200000-b1200038

ipsec0 Link encap:Ethernet HWaddr 00:50:8B:9A:AD:3E
inet addr:1.2.3.146 Mask:255.255.255.240 UP RUNNING NOARP
MTU:16260 Metric:1 RX packets:378 errors:0 dropped:0
overruns:0 frame:0 TX packets:2120 errors:0 dropped:0 overruns:0
carrier:0 collisions:0 txqueuelen:10
RX bytes:80656 (78.7 Kb) TX bytes:764020 (746.1 Kb)

# ip rule list
0: from all lookup local
32764: from 1.2.3.146 lookup 33
32766: from all lookup main
32767: from all lookup 253

# ip route list
165.21.83.88 via 1.2.3.145 dev eth1
1.2.3.144/28 dev eth1 proto kernel scope link src 1.2.3.146
1.2.3.144/28 dev ipsec0 proto kernel scope link src 1.2.3.146
192.168.64.0/18 dev eth0 proto kernel scope link src 192.168.64.252
169.254.0.0/16 dev eth0 proto kernel scope link src 169.254.1.252
127.0.0.0/8 dev lo scope link
default via 1.2.3.145 dev eth1

# ip route list table 33
172.28.0.0/16 via 1.2.3.145 dev ipsec0 src 192.168.64.252

yet, locally originating packets to the remote LAN listed in table 33
go out via eth1 with the wrong source address:

#172.28.1.1 via 1.2.3.145 dev eth1 src 1.2.3.146 \ cache mtu
1500 advmss 1460

and:

# tcpdump -i eth1 icmp -n &
# ping 172.18.1.1
PING 172.28.1.1 (172.28.1.1): 56 octets data
16:32:02.168353 1.2.3.146 > 172.28.1.1: icmp: echo request (DF)
16:32:03.166479 1.2.3.146 > 172.28.1.1: icmp: echo request (DF)
16:32:04.166564 1.2.3.146 > 172.28.1.1: icmp: echo request (DF)

However, incoming packets via ipsec0 from 172.28.1.1 are properly replied
via ipsec0.

Question: How can I ensure that locally generated packets are actually
looked up in the ip rule tables and follow the routes set therein?
I know I am missing something, but what?

regards