remote box outside interface: 63.147.76.30, inside interface 192.168.241.15 remote network: #ike esp from 192.168.0.0/16 to 10.50.3.0/24 peer 71.196.227.124 #ike esp from 63.147.76.30 to 10.50.3.0/24 peer 71.196.227.124 #ike esp from 63.147.76.30 to 71.196.227.124 Maybe try this? ike esp from 192.168.0.0/16 to 10.50.3.0/24 peer 71.196.227.194 ike esp from 63.147.76.30 to 10.50.3.0/24 peer 71.196.227.194 ike esp from 63.147.76.30 to 71.196.227.194 # netstat -rnf encap Routing tables Encap: Source Port Destination Port Proto SA(Address/Proto/Type/Direction) 10.50.3/24 0 192.168/16 0 0 71.196.227.124/esp/use/in 192.168/16 0 10.50.3/24 0 0 71.196.227.124/esp/require/out 10.50.3/24 0 63.147.76.30/32 0 0 71.196.227.124/esp/use/in 63.147.76.30/32 0 10.50.3/24 0 0 71.196.227.124/esp/require/out # ipsecctl -sf flow esp in from 10.50.3.0/24 to 192.168.0.0/16 peer 71.196.227.124 srcid 63.147.76.30/32 dstid 71.196.227.124/32 type use flow esp out from 192.168.0.0/16 to 10.50.3.0/24 peer 71.196.227.124 srcid 63.147.76.30/32 dstid 71.196.227.124/32 type require flow esp in from 10.50.3.0/24 to 63.147.76.30 peer 71.196.227.124 srcid 63.147.76.30/32 dstid 71.196.227.124/32 type use flow esp out from 63.147.76.30 to 10.50.3.0/24 peer 71.196.227.124 srcid 63.147.76.30/32 dstid 71.196.227.124/32 type require home box outside interface 71.192.227.124 inside interface 10.50.3.1 home network: ike passive esp from 10.50.3.0/24 to 192.168.0.0/16 peer 63.147.76.30 ike passive esp from 71.192.227.194 to 192.168.0.0/16 peer 63.147.76.30 ike passive esp from 71.196.227.194 to 63.147.76.30 # netstat -rnf encap Routing tables Encap: Source Port Destination Port Proto SA(Address/Proto/Type/Direction) 192.168/16 0 10.50.3/24 0 0 63.147.76.30/esp/use/in 10.50.3/24 0 192.168/16 0 0 63.147.76.30/esp/require/out 63.147.76.30/32 0 10.50.3/24 0 0 63.147.76.30/esp/use/in 10.50.3/24 0 63.147.76.30/32 0 0 63.147.76.30/esp/require/out # ipsecctl -sf flow esp in from 192.168.0.0/16 to 10.50.3.0/24 peer 63.147.76.30 srcid 71.196.227.124/32 dstid 63.147.76.30/32 type use flow esp out from 10.50.3.0/24 to 192.168.0.0/16 peer 63.147.76.30 srcid 71.196.227.124/32 dstid 63.147.76.30/32 type require flow esp in from 63.147.76.30 to 10.50.3.0/24 peer 63.147.76.30 srcid 71.196.227.124/32 dstid 63.147.76.30/32 type use flow esp out from 10.50.3.0/24 to 63.147.76.30 peer 63.147.76.30 srcid 71.196.227.124/32 dstid 63.147.76.30/32 type require