IPSEC ikev1 VPN site to site StrongSwan

[mpa]

I am using the following firewall configuration on a device which serves as NAT router and IPsec gateway.
Perhaps you can build your own config based on it:

IPsec site-to-site tunnel

The wan interface is set up with masquerading (source NAT) by default. This affects both plaintext traffic to the internet and VPN traffic towards the remote LAN. When IPsec decides whether to pass through or to tunnel a packet, it compares the packet's source IP, destination IP, and optionally other header fields with its own configured policy. Masquerading changes the source IP, which causes a mismatch in this comparison, and the packet is not sent through the VPN. You have to make sure the …