ipsec.conf

conn custom-remote-access
        keyexchange=ikev2
        type=tunnel
        ike=aes128-sha1-modp1024!
        esp=aes128-sha1-modp1024!
        fragmentation=yes

        leftcert=/routerCert.der
        leftsendcert=always
        rightauth=pubkey

        leftupdown=/updown.sh
        mark=1024
        auto=route

        left=%any
        leftsubnet=192.168.1.0/24
        leftid="@example.com"

        right=%any
        rightsourceip=192.168.1.100/24
        rightdns=192.168.1.1
        rightid="*@example.com"