This test sets up east to send a packet to sunset-oe (behind west). It does so in the clear. East is configured to do so in the clear, but accept an oe connection if the peer tries. West, when dealing with the return packet thinks that it is allowed to do OE, so it attempts. East is set up to accept OE, so it negotiates the connection, and the *return* packet and all subsequent traffic gets encrypted. Contrast this with clear-02, where the same scenario occurs, but east is not configured to accept OE for this address, so it will refuse the connection.