OVH's DDOS Mitigation System was constantly blocking my IPSEC traffic when I had it encapsulated in UDP. Once I switched it back to native IPSEC (the IP protocol, not in a UDP wrapper for NAT traversal) it stopped blocking it. Repeated tickets to OVH resulted in no changes or fixes. They just ignored the tickets or were useless. Hope you don't need IPSEC with NAT traversal for them!