@Virgo Hi, this manuals are for different VPN types. I want to use Client-to-Site VPN with IPSec server (so stack will be IKEv2/IPSec). I have multiple subnetworks and only this type allows me to select to which subnetwork given client should have access. For other VPN types I can define list of networks only per server, not per client. 
 

  @mpjlech 

If you are behind the NAT, you have to modify registry to make IPSec VPN work.

2 methods (1a or 1b):

Step 1a) Open the Registry Editor (regedit.exe) and go to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent

Create a DWORD parameter with the name AssumeUDPEncapsulationContextOnSendRule and the value 2;

Step 1b) Open the Powershell:

Set-ItemProperty -Path "HKLM:SYSTEM\CurrentControlSet\Services\PolicyAgent" -Name "AssumeUDPEncapsulationContextOnSendRule" -Type DWORD -Value 2 –Force;

Step 2)

Restart computer.