Device: GL-E5800 (Mudi), firmware 4.8.5, modem RG650V-EU (baseband RG650VEUJ00ADR02A04G8G), on a Telekom DE 5G/4G SIM.
TL;DR: A certificate-based IKEv2/IPsec VPN client (NCP Secure Client) on a laptop behind the router could not connect over the cellular WAN. The exact same laptop/client connects fine over Ethernet WAN and over a phone hotspot on the same carrier. Root cause: Network Acceleration in Auto/Hardware mode. Setting Network > Network Acceleration > Mode = Software fixes it completely.
Symptom
IKE_AUTH times out on the client: IKEv2(AUTH) - Could not contact Gateway ... retry timeout - max retries.
Diagnosis (tcpdump on the cellular WAN interface)
- Outbound IKE (UDP 500 and 4500, incl. NAT-T) leaves the WAN correctly.
- Zero inbound packets from the gateway are seen at the WAN - not even a reply to the small (~400 byte) IKE_SA_INIT. Since the replies never appear even in tcpdump, they are being discarded by the IPA hardware offload before reaching the Linux/netfilter path.
- Ruled out: MTU (a ~400 byte INIT never fragments), firewall (ESP/ISAKMP allowed), SIP/IPsec ALG (off), and any carrier/gateway block (a phone hotspot on the same carrier works).
The A/B result (smoking gun)
- Network Acceleration Mode = Hardware / Auto -> IPsec broken (0 inbound as above)
- Network Acceleration Mode = Software -> IPsec works (full handshake + ESP)
Fix / workaround
Network > Network Acceleration > Mode = Software (uci: ipacm.global.actype='flow_offloading'). No APN change needed; native IPv6 is preserved; acceleration stays on.
This looks like the same underlying issue as the older (now closed) thread "IPSEC/L2TP thru GL-X3000 not working on 5G NSR carrier". There the workaround was a firmware reset, but that only fixes it temporarily - it clears the offload state until the next re-dial. Mode = Software is the durable fix.
Suggestion
On cellular, "Auto" appears to select the Hardware/IPA path, which silently drops inbound IPsec with no error or indication. Could "Auto" prefer Software on cellular when IPsec is in use, or at least surface a warning that Hardware acceleration is incompatible with IPsec passthrough on the modem data path? This is very hard to diagnose because the drop is invisible even to tcpdump.