RoadWarrior VPN firewall rules

How can I enforce firewall rules to only work with IPSEC clients? I want to allow only clients that are running IPSEC with Astaro to pass through to NAT'ed ports.

Example:


VPN
0.0.0.0/255.255.255.255.255

External
192.168.2.1/255.255.255.255

DMZ 
192.168.1.1/255.255.255.255

DBServer
192.168.1.2/255.255.255.255


Source      Port   Destination  Port
192.168.2.1 1521   192.168.1.2  1521


DMZ => External
192.168.2.0 => 192.168.1.0

:Currently using 


External PostGres DBServer allow

:Want, but doesn't work. after it passes the IPSEC tunnel, the packet is dropped by firewall


VPN PostGRES DMZ allow

  [:(]

This thread was automatically locked due to age.