LAN                                                                              LAN
192.168.4.0/24 (192.168.2.1_______________IPSEC_____________________192.168.2.3) 192.168.3.0/24 (this tunnel works great)
    |                                                                             |
    |                                                                             |
    |                                                                             |
DMZ     (a packet send from 192.168.2.2 to 192.168.3.0/24 is lost)               DMZ
192.168.2.0/24 <---- wi-fi(10.10.10.1)<------>wi-fi(10.10.10.2)<---------->192.168.2.0/24
         (a packet send from 192.168.3.0 to 192.168.2.2 works fine)

HAVE NO FIREWALL between this nodes...