Externe Erreichbarkeit einer per Vodafone LTE verbundenen FritzBox

connections {
   fritzbox {
      local_addrs = 212.132.xxx.xxx
      remote_addrs = 0.0.0.0/0
      local {
          auth = psk
          id = 212.132.xxx.xxx
          }
      remote {
          auth = psk
          id = keyid:strongswan@fritz.box
          }
      children {
          net {
              local_ts = 172.25.24.0/23
              remote_ts = 192.168.111.0/24
              esp_proposals = aes256-sha512-modp1024,aes256-sha1-modp1024
              }
          }
       version = 1
	   proposals = aes256-sha512-modp1024,aes256-sha1-modp1024
	}


   ikev2-mobile-defaults {
      unique = replace
      version = 2
      proposals = aes256-sha512-modp2048,aes256-sha256-ecp256,aes256-sha256-modp2048,aes256-sha256-modp1024
      send_cert = always
      pools = pool-ipv4
      local_addrs = 212.132.xxx.xxx
      remote_addrs = 0.0.0.0/0,::/0
      local {
         auth = pubkey
         certs = server-cert.pem
         id = fqdn:212-132-xxx-xxx.nip.io
      }
      remote {
         id = %any
         auth = eap-mschapv2
         eap_id = %any
       }
       children {
          ikev2-mobile {
          local_ts = 0.0.0.0/0
          esp_proposals = aes256-sha512,aes256-sha384,aes256-sha256,aes256-sha1
          start_action = trap
          }
      }
   }
}
pools {
    pool-ipv4 {
    addrs = 172.25.25.0/24
    dns = 94.140.14.14,94.140.15.15
    }
}
secrets {
 eap-1 {
     id = user1
     secret = "passwort1"    
     }
 eap-2 {
     id = user2
     secret = "passwort 2"    
     }
 ike-3 {
      id = keyid:strongswan@fritz.box
      secret = "passwort"    
     }
}

vpncfg {
        connections {
                enabled = yes;
                editable = no;
                conn_type = conntype_lan;
                name = "StrongSwan";    
                always_renew = yes;
                reject_not_encrypted = no;
                dont_filter_netbios = yes;
                localip = 0.0.0.0;
                local_virtualip = 0.0.0.0;
                remoteip = 212.132.xxx.xxx;
                remote_virtualip = 0.0.0.0;
                keepalive_ip = 172.25.24.1;
			localid {
                        key_id = "strongswan@fritz.box";    
                        }
                        remoteid {
                        ipaddr = 212.132.xxx.xxx;
                        }
                mode = phase1_mode_idp;
                phase1ss = "LT8h/all/all/all";    
                keytype = connkeytype_pre_shared;
                key = "key";    
                cert_do_server_auth = no;
                use_nat_t = yes;
                use_xauth = no;
                use_cfgmode = no;
                phase2localid {
                        ipnet {
                                ipaddr = 192.168.111.0;
                                mask = 255.255.255.0;
                        }
                }
                phase2remoteid {
                        ipnet {
                                ipaddr = 172.25.24.0;
                                mask = 255.255.254.0;
                        }
                }
                phase2ss = "esp-all-all/ah-none/comp-all/pfs";    
                accesslist = "permit ip any 172.25.24.0 255.255.254.0";    
        }
        ike_forward_rules = "udp 0.0.0.0:500 0.0.0.0:500",     
                            "udp 0.0.0.0:4500 0.0.0.0:4500";    
}

# The loopback network interface
auto lo
iface lo inet loopback
iface lo inet static
address 172.25.24.1
netmask 255.255.255.255

fritzbox: #5, ESTABLISHED, IKEv1, 7dcb3e396ed4b7ac_i e235a82f1cf52da8_r*
  local  '212.132.xxx.xxx' @ 212.132.xxx.xxx[4500]  
  remote '73:74:72:6f:6e:xx:73:77:61:xx:40:66:xx:69:74:7a:xx:62:xx:78' @ 109.43.xxx.xxx[6330]  
  AES_CBC-256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_1024
  established 26s ago, rekeying in 13715s
  net: #5, reqid 2, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-256/HMAC_SHA2_512_256/MODP_1024
    installed 25s ago, rekeying in 3246s, expires in 3935s
    in  c83ecfd7,    128 bytes,     1 packets,    26s ago
    out de7d42ba,      0 bytes,     0 packets
    local  172.25.24.0/23
    remote 192.168.111.0/24
ikev2-mobile-defaults: #3, ESTABLISHED, IKEv2, 34009e2ff5f7f5a4_i ed5b76a57029c8dd_r*
  local  '212-132-xxx-xxx.nip.io' @ 212.132.xxx.xxx[4500]  
  remote '100.80.xxx.xxx' @ 109.43.xxx.xxx[30628] EAP: 'user1' [172.25.25.1]  
  AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
  established 753s ago, rekeying in 12866s
  ikev2-mobile: #3, reqid 1, INSTALLED, TUNNEL-in-UDP, ESP:AES_CBC-256/HMAC_SHA2_256_128
    installed 753s ago, rekeying in 2513s, expires in 3207s
    in  cd233a78,   8472 bytes,   123 packets,     3s ago
    out 0d7cddcf,      0 bytes,     0 packets
    local  0.0.0.0/0
    remote 172.25.25.1/32

15[NET] received packet: from 109.43.xxx.xxx[29476] to 212.132.xxx.xxx[500] (370 bytes)
15[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) ]
15[IKE] 109.43.xxx.xxx is initiating an IKE_SA
15[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
15[IKE] remote host is behind NAT
15[IKE] sending cert request for "C=DE, CN=RasPi CA"  
15[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(HASH_ALG) N(CHDLESS_SUP) N(MULT_AUTH) ]
15[NET] sending packet: from 212.132.xxx.xxx[500] to 109.43.xxx.xxx[29476] (305 bytes)
14[NET] received packet: from 109.43.xxx.xxx[7587] to 212.132.xxx.xxx[4500] (384 bytes)
14[ENC] unknown attribute type INTERNAL_DNS_DOMAIN
14[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr CPRQ(ADDR MASK DHCP DNS ADDR6 DHCP6 DNS6 DOMAIN) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr N(MOBIKE_SUP) ]
14[CFG] looking for peer configs matching 212.132.xxx.xxx[212-132-xxx-xxx.nip.io]...109.43.xxx.xxx[100.80.xxx.xxx]
14[CFG] selected peer config 'ikev2-mobile-defaults'  
14[IKE] initiating EAP_IDENTITY method (id 0x00)
14[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding
14[IKE] peer supports MOBIKE
14[IKE] authentication of '212-132-xxx-xxx.nip.io' (myself) with RSA_EMSA_PKCS1_SHA2_256 successful  
14[IKE] sending end entity cert "CN=212-132-xxx-xxx.nip.io"  
14[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
14[NET] sending packet: from 212.132.xxx.xxx[4500] to 109.43.xxx.xxx[7587] (1216 bytes)
11[NET] received packet: from 109.43.xxx.xxx[7587] to 212.132.xxx.xxx[4500] (80 bytes)
11[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
11[IKE] received EAP identity 'user1'  
11[IKE] initiating EAP_MSCHAPV2 method (id 0xBB)
11[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]
11[NET] sending packet: from 212.132.xxx.xxx[4500] to 109.43.xxx.xxx[7587] (112 bytes)
10[NET] received packet: from 109.43.xxx.xxx[7587] to 212.132.xxx.xxx[4500] (144 bytes)
10[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]
10[ENC] generating IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]
10[NET] sending packet: from 212.132.xxx.xxx[4500] to 109.43.xxx.xxx[7587] (144 bytes)
08[NET] received packet: from 109.43.xxx.xxx[7587] to 212.132.xxx.xxx[4500] (80 bytes)
08[ENC] parsed IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]
08[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
08[ENC] generating IKE_AUTH response 4 [ EAP/SUCC ]
08[NET] sending packet: from 212.132.xxx.xxx[4500] to 109.43.xxx.xxx[7587] (80 bytes)
05[NET] received packet: from 109.43.xxx.xxx[7587] to 212.132.xxx.xxx[4500] (112 bytes)
05[ENC] parsed IKE_AUTH request 5 [ AUTH ]
05[IKE] authentication of '100.80.xxx.xxx' with EAP successful  
05[IKE] authentication of '212-132-xxx-xxx.nip.io' (myself) with EAP  
05[IKE] IKE_SA ikev2-mobile-defaults[3] established between 212.132.xxx.xxx[212-132-xxx-xxx.nip.io]...109.43.xxx.xxx[100.80.xxx.xxx]
05[IKE] scheduling rekeying in 13619s
05[IKE] maximum IKE_SA lifetime 15059s
05[IKE] peer requested virtual IP %any
05[CFG] reassigning offline lease to 'user1'  
05[IKE] assigning virtual IP 172.25.25.1 to peer 'user1'  
05[IKE] peer requested virtual IP %any6
05[IKE] no virtual IP found for %any6 requested by 'user1'  
05[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
05[IKE] CHILD_SA ikev2-mobile{3} established with SPIs cd233a78_i 0d7cddcf_o and TS 0.0.0.0/0 === 172.25.25.1/32
05[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) ]
05[NET] sending packet: from 212.132.xxx.xxx[4500] to 109.43.xxx.xxx[7587] (272 bytes)

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet 172.25.24.1/32 scope global lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 02:xx:bf:8d:xx:f9 brd ff:ff:ff:ff:ff:ff
    altname enp0s6
    inet 212.132.xxx.xxx/32 metric 100 scope global dynamic ens6
       valid_lft 560sec preferred_lft 560sec
    inet6 2a01:xxx:31f:xxxx::1/128 scope global dynamic noprefixroute
       valid_lft 3074sec preferred_lft 2074sec
    inet6 fe80::1:xxxx:fe8d:xxxx/64 scope link
       valid_lft forever preferred_lft forever