Using the following ipsec.conf configuration:
conn %default ikelifetime=60m keylife=20m keyingtries=3 rekeymargin=3m keyexchange=ikev2 esp=aes-aes256-sha-modp1024,aes256-sha512-modp4096 ike=aes-aes256-sha-modp1024,aes256-sha512-modp4096 leftcert=servercert.pem leftid=server.strongswan.org lefthostaccess=yes leftfirewall=yes conn roadwarrior left=%any right=%any leftsubnet=0.0.0.0/0 rightsourceip=%dhcp auto=add
When a client connects from behind the NAT (e.g. private IP range, for example 192.168.1.0/24) it's local routing (in the 192.xxx range) doesn't work anymore as it is forwarded via the tunnel (gateway has no idea about external private networks).
The question is - how to let all traffic go through the tunnel except for the client's own network.