2 канала интернет и IPSec не могу настроить

#!/bin/bash
 
# LAN interface
IF0="eth0"
# WAN interface 1 
IF1="eth1"
# WAN interface 2 
IF2="eth2"
 
IP1="`ifconfig $IF1 | grep 'inet addr:' | cut -d: -f2 | awk '{print $1}'`"
IP2="`ifconfig $IF2 | grep 'inet addr:' | cut -d: -f2 | awk '{print $1}'`"
# gateway 1
#Этот кусок кода позволит вычислить IP шлюза который периодически меняется
#скажем если у вас есть канал ppp0
#P1="`ifconfig $IF1 | grep 'P-t-P:'| cut -d: -f3 | awk '{ print $1}'`"
P1="10.10.10.1"
# gateway 2
P2="217.xxx.xxx.XXX"
 
# LAN netmask
P0_NET="192.168.0.0/27"
# WAN1 netmask
P1_NET="10.10.10.0/24"
# WAN2 netmask
P2_NET="217.xxx.xxx.0/30"
 
TBL1="Inet1"
TBL2="Inet2"
 
# Realtive weight of channels bandwidth
W1="2"
W2="1"

#!/bin/bash
. /etc/balance/vars.sh
 
ip route add $P1_NET dev $IF1 src $IP1 table $TBL1 > /dev/null 2>&1
ip route add default via $P1 table $TBL1 > /dev/null 2>&1
ip route add $P2_NET dev $IF2 src $IP2 table $TBL2 > /dev/null 2>&1
ip route add default via $P2 table $TBL2 > /dev/null 2>&1
 
ip route add $P1_NET dev $IF1 src $IP1 > /dev/null 2>&1
ip route add $P2_NET dev $IF2 src $IP2 > /dev/null 2>&1
 
ip route add default via $P1 > /dev/null 2>&1
 
ip rule add from $IP1 table $TBL1 > /dev/null 2>&1
ip rule add from $IP2 table $TBL2 > /dev/null 2>&1
  
ip route add $P0_NET dev $IF0 table $TBL1 > /dev/null 2>&1
ip route add $P2_NET dev $IF2 table $TBL1 > /dev/null 2>&1
ip route add 127.0.0.0/8 dev lo table $TBL1 > /dev/null 2>&1
ip route add $P0_NET dev $IF0 table $TBL2 > /dev/null 2>&1
ip route add $P1_NET dev $IF1 table $TBL2 > /dev/null 2>&1
ip route add 127.0.0.0/8 dev lo table $TBL2 > /dev/null 2>&1
 
iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -s $P0_NET -o $IF1 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $P0_NET -o $IF2 -j MASQUERADE

#!/bin/bash
 
. /etc/balance/vars.sh
 
OLDIF1=0
OLDIF2=0
 
. /etc/balance/routing.sh
while true; do
. /etc/balance/vars.sh
ping -c 3 -s 100 $P1 -I $IF1 > /dev/null
if [ $? -ne 0 ]; then
echo "Failed " $IF1 " GW " $P1 " !"
NEWIF1=0
else
NEWIF1=1
fi
 
ping -c 3 -s 100 $P2 -I $IF2 > /dev/null
if [ $? -ne 0 ]; then
echo "Failed " $IF2 " GW " $P2 " !"
NEWIF2=0
else
NEWIF2=1
fi
 
if (( ($NEWIF1!=$OLDIF1) || ($NEWIF2!=$OLDIF2) )); then
echo "!!!Изменение маршрутов!!!"
if (( ($NEWIF1==1) && ($NEWIF2==1) )); then
echo "Оба канала (объединенные Inet1 + Inet2)"
echo "Внешний IP 1 канала: " $IP1 "GW " $P1
echo "Внешний IP 2 канала: " $IP2 "GW " $P2
ip route delete default
ip route add default scope global nexthop via $P1 dev $IF1 weight $W1 \
nexthop via $P2 dev $IF2 weight $W2
#NEWIF1=0
#NEWIF2=0
elif (( ($NEWIF1==1) && ($NEWIF2==0) )); then
echo "Первый канал – Yota"
echo "Внешний IP: " $IP1 "GW " $P1
ip route delete default
ip route add default via $P1 dev $IF1
#NEWIF1=0
#NEWIF2=0
elif (( ($NEWIF1==0) && ($NEWIF2==1) )); then
echo "Второй канал – TEL"
echo "Внешний IP: " $IP2 "GW " $P2
ip route delete default
ip route add default via $P2 dev $IF2
#NEWIF1=0
#NEWIF2=0
fi
 
else
#echo "Без изменений"
    if (( ($NEWIF1==1) && ($NEWIF2==1) )); then
    echo "Оба канала - Yota + TEL"
    echo "Внешний IP 1 канала: " $IP1 "GW " $P1
    echo "Внешний IP 2 канала: " $IP2 "GW " $P2
    elif (( ($NEWIF1==1) && ($NEWIF2==0) )); then
    echo "Первый канал – Yota " $IP1 "GW " $P1
    elif (( ($NEWIF1==0) && ($NEWIF2==1) )); then
    echo "Второй канал – TEL " $IP2 "GW " $P2
    elif (( ($NEWIF1==0) && ($NEWIF2==0) )); then
    echo "!!! Не один из каналов не реботает !!!"
    fi
fi
 
OLDIF1=$NEWIF1
OLDIF2=$NEWIF2
sleep 3
done

# Generated by iptables-save v1.4.7 on Tue Aug 14 07:51:12 2007
*mangle
:PREROUTING ACCEPT [901:134616]
:INPUT ACCEPT [123:24456]
:FORWARD ACCEPT [778:110160]
:OUTPUT ACCEPT [110:47748]
:POSTROUTING ACCEPT [886:157642]
-A FORWARD -d 192.168.0.10/32 -o eth2 -j MARK --set-xmark 0x64/0xffffffff 
-A FORWARD -s 192.168.0.10/32 -i eth2 -j MARK --set-xmark 0x64/0xffffffff 
COMMIT
# Completed on Tue Aug 14 07:51:12 2007
# Generated by iptables-save v1.4.7 on Tue Aug 14 07:51:12 2007
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -s 192.168.0.0/24 -o eth1 -j MASQUERADE 
-A POSTROUTING -s 192.168.0.0/24 -o eth2 -j MASQUERADE 
-A POSTROUTING -s 10.1.2.0/24 -j SNAT --to-source 217.xxx.xxx.xxx # без этого не работает интернет через VPN у подключенного клиента
COMMIT
# Completed on Tue Aug 14 07:51:12 2007
# Generated by iptables-save v1.4.7 on Tue Aug 14 07:51:12 2007
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -i eth2 -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -i eth2 -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -i lo -j ACCEPT 
-A INPUT -s 192.168.0.0/24 -i eth0 -j ACCEPT
-A INPUT -i eth1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -i eth2 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -j DROP 
-A FORWARD -s 192.168.0.0/24 -j ACCEPT 
-A FORWARD -d 192.168.0.0/24 -j ACCEPT
-A FORWARD -s 10.1.2.0/24 -j ACCEPT #
-A FORWARD -d 10.1.2.0/24 -j ACCEPT # Разрешаем доступ в интернет клиентам VPN
-A FORWARD -i eth1 -j DROP 
-A FORWARD -i eth2 -j DROP 
COMMIT
# Completed on Tue Aug 14 07:51:12 2007

version 2.0
config setup
    dumpdir=/var/run/pluto/
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v6:fd00::/8,%v6:fe80::/10
    protostack=netkey
    oe=off
conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT
conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=8
    ikelifetime=8h
    keylife=1h
    type=transport
    left=217.xxx.xxx.xxx
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any

iptables -t mangle -A OUTPUT -p tcp --dport 25 -j MARK --set-mark 1

iptables -t mangle -A OUTPUT -d 10.1.2.0  -j MARK --set-mark 1

ip rule add priority 100 fwmark 1 table $TBL1
ip rule add priority 110 fwmark 2 table $TBL2
ip rule add priority 120 from  $IP1 table $TBL1
ip rule add priority 130 from  $IP2 table $TBL2