ip xfrm policy
src 0.0.0.0/0 dst 10.10.10.1/32
        dir out priority 383615
        tmpl src 185.217.198.123 dst 213.234.251.43
                proto esp spi 0xc4c763ab reqid 1 mode tunnel
src 10.10.10.1/32 dst 0.0.0.0/0
        dir fwd priority 383615
        tmpl src 213.234.251.43 dst 185.217.198.123
                proto esp reqid 1 mode tunnel
src 10.10.10.1/32 dst 0.0.0.0/0
        dir in priority 383615
        tmpl src 213.234.251.43 dst 185.217.198.123
                proto esp reqid 1 mode tunnel
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket in priority 0
src 0.0.0.0/0 dst 0.0.0.0/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0
src ::/0 dst ::/0
        socket in priority 0
src ::/0 dst ::/0
        socket out priority 0]

 ip r s table all
10.10.10.1 via 185.217.198.1 dev ens3 table 220 proto static
default via 185.217.198.1 dev ens3 onlink
10.10.10.0/24 dev ens3 scope link
185.217.198.0/24 dev ens3 proto kernel scope link src 185.217.198.123
192.168.81.0/24 dev ipsec0 scope link
broadcast 127.0.0.0 dev lo table local proto kernel scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
broadcast 185.217.198.0 dev ens3 table local proto kernel scope link src 185.217.198.123
local 185.217.198.123 dev ens3 table local proto kernel scope host src 185.217.198.123
broadcast 185.217.198.255 dev ens3 table local proto kernel scope link src 185.217.198.123
::1 dev lo proto kernel metric 256 pref medium
2a09:5302:ffff::/48 dev ens3 proto kernel metric 256 pref medium
fe80::/64 dev ens3 proto kernel metric 256 pref medium
fe80::/64 dev ipsec0 proto kernel metric 256 pref medium
default via 2a09:5302:ffff::1 dev ens3 metric 1024 onlink pref medium
local ::1 dev lo table local proto kernel metric 0 pref medium
local 2a09:5302:ffff::18d4 dev ens3 table local proto kernel metric 0 pref medium
local fe80::200:5efe:b9d9:c67b dev ipsec0 table local proto kernel metric 0 pref medium
local fe80::5054:ff:fe2c:43d0 dev ens3 table local proto kernel metric 0 pref medium
multicast ff00::/8 dev ens3 table local proto kernel metric 256 pref medium
multicast ff00::/8 dev ipsec0 table local proto kernel metric 256 pref medium

ip ru s
0:      from all lookup local
220:    from all lookup 220
32766:  from all lookup main
32767:  from all lookup default

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         gw.firstbyte.ru 0.0.0.0         UG    0      0        0 ens3
10.10.10.0      0.0.0.0         255.255.255.0   U     0      0        0 ens3
localnet        0.0.0.0         255.255.255.0   U     0      0        0 ens3
192.168.81.0    0.0.0.0         255.255.255.0   U     0      0        0 ipsec0


  GNU nano 4.8                                        /etc/ipsec.conf                                                   config setup
        charondebug="ike 1, knl 1, cfg 0"
        uniqueids=no

conn grepresharedkey
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=@server_domain_or_IP(белый ip)
    leftcert=server-cert.pem
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-mschapv2
    rightsourceip=10.10.10.0/24
    rightdns=8.8.8.8,8.8.4.4
    rightsendcert=never
    eap_identity=%identity
    ike=chacha20poly1305-sha512-curve25519-prfsha512,aes256gcm16-sha384-prfsha384-ecp384,aes256-sha1-modp1024,aes128-sh>    esp=chacha20poly1305-sha512,aes256gcm16-ecp384,aes256-sha256,aes256-sha1,3des-sha1!