For some reason, it had binded on eth1 rather than eth0 (it’s supposed to bind on both).
Shrewsoft uses IPSEC_Pluto for IKE connections, check out this manpage: http://www.linuxsecurity.com/resource_files/cryptography/FreeSWAN-HOWTO/manpage.d/ipsec_pluto.8.html
To refresh the interfaces (restarting didn’t work for me, but this did), use:
ipsec whack –listen
UPDATE: I was wrong! It’s strongswan that uses IPSEC_PLUTO, Shrewsoft uses it’s own stuff, and the reason my Shrewsoft wasn’t making the connections as it should was because of conflicts with strongswan; once I uninstalled that it started working again.