My sysctl.conf. what I need to make VPN over IPSEC ?
 

net.ipv4.ip_forward=1
net.ipv4.conf.all.rpfilter=0
net.ipv4.conf.default.rpfilter=0
net.ipv4.conf.eth0.rpfilter=0
net.ipv4.conf.eth1.rpfilter=0
net.ipv4.conf.eth2.rpfilter=0
net.ipv4.conf.lo.rpfilter=0
net.ipv4.conf.ipsec0.rpfilter=0

The net.ipv4.ip_forward=1 is ok. but the rest not...
why it fails ?

If you still have the problem, then repost at Linux-Networking. This forum doesn't exactly get huge amounts of activity, as you can tell :-) . Otherwise, this post is just to get this thread off the 0 replies list.