### allow ipsec traffic from your wan port to the router
iptables -A input_wan -p esp              -j ACCEPT # allow IPSEC
iptables -A input_wan -p udp --dport 500  -j ACCEPT # allow ISAKMP
iptables -A input_wan -p udp --dport 4500 -j ACCEPT # allow NAT-T

### disable nat for the remote peer subnet, in this example 192.168.2.0/24
iptables -t nat -A postrouting_rule -d 172.16.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 172.22.0.0/16 -j ACCEPT
iptables -t nat -A postrouting_rule -d 192.168.0.0/16 -j ACCEPT

### Allow any traffic between your local LAN and remote peer LAN
iptables -A forwarding_rule -i $LAN -o ipsec0 -j ACCEPT
iptables -A forwarding_rule -i ipsec0 -o $LAN -j ACCEPT