IPSec connections in mode vti fail because of bugs in iproute2. With the latest version, everything works.
https://git.ipfire.org/?p=ipfire-3.x.git;a=commitdiff;h=da6dc1c016038aed387b8f1fa4fd9baf2a7eaeea