<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000066" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 03/25/2018 04:02 PM, Noel Kuntze
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:0e069fe7-bd84-9aa9-a70f-e0c3b69b739d@thermi.consulting">
<pre wrap="">Just use two conn definitions. One for your LAN and one for the initiators on the Internet.
</pre>
</blockquote>
<br>
I tried to, but got the error shown. The Android app won't connect,
and the responder's log says a VIP is required. The error isn't
direct, but a search shows you in an earlier listserv recommending
that solution for my exact error.<br>
<br>
And when I add a local VIP, it goes instead to the remote phone.
And any ping from the phone to responder, instead goes out the
through the public IP.<br>
<br>
This is using swanctl, certs, no SELinux, and open firewall. The
IPSec gateway is inside the LAN and reached by DNAT in and SNAT out.<br>
</body>
</html>