/ip ipsec profile
set [ find default=yes ] enc-algorithm=aes-256,aes-192,aes-128
add dh-group=modp2048 dpd-interval=30s enc-algorithm=aes-256 hash-algorithm=sha256 name=Site_to_site

/ip ipsec peer
add address=94.177.X.X/32 exchange-mode=ike2 name=VPS2 profile=Site_to_site send-initial-contact=no
add address=89.38.X.X/32 exchange-mode=ike2 name=VPS1 profile=Site_to_site send-initial-contact=no

/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 pfs-group=none
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc name=Site_to_site pfs-group=none

/ip ipsec identity
add auth-method=digital-signature certificate=Mikrotik peer=VPS1
add auth-method=digital-signature certificate=Mikrotik peer=VPS2

/ip ipsec policy
add dst-address=10.8.0.0/24 level=unique peer=VPS1 proposal=Site_to_site sa-dst-address=89.38.X.X sa-src-address=84.236.X.X src-address=10.10.15.0/24 tunnel=yes
add dst-address=10.8.0.0/24 level=unique peer=VPS1 proposal=Site_to_site sa-dst-address=89.38.X.X sa-src-address=84.236.X.X src-address=10.10.16.0/24 tunnel=yes
add dst-address=10.8.0.0/24 level=unique peer=VPS1 proposal=Site_to_site sa-dst-address=89.38.X.X sa-src-address=84.236.X.X src-address=10.10.14.0/24 tunnel=yes
add dst-address=10.8.0.0/24 level=unique peer=VPS1 proposal=Site_to_site sa-dst-address=89.38.X.X sa-src-address=84.236.X.X src-address=10.10.120.0/24 tunnel=yes
add dst-address=10.9.0.0/24 level=unique peer=VPS2 proposal=Site_to_site sa-dst-address=94.177.X.X sa-src-address=84.236.X.X src-address=10.10.15.0/24 tunnel=yes
add dst-address=10.9.0.0/24 level=unique peer=VPS2 proposal=Site_to_site sa-dst-address=94.177.X.X sa-src-address=84.236.X.X src-address=10.10.16.0/24 tunnel=yes
add dst-address=10.9.0.0/24 level=unique peer=VPS2 proposal=Site_to_site sa-dst-address=94.177.X.X sa-src-address=84.236.X.X src-address=10.10.120.0/24 tunnel=yes
add dst-address=10.9.0.0/24 level=unique peer=VPS2 proposal=Site_to_site sa-dst-address=94.177.X.X sa-src-address=84.236.X.X src-address=10.10.14.0/24 tunnel=yes