conn access-vpn
    # added the following two lines to maybe work with OCP
    ike=aes256-sha2_512;modp2048,aes128-sha2_512;modp2048
    esp=aes_gcm256-null,aes_gcm128-null,aes256-sha2_512,aes128-sha2_512
    # The server's actual IP goes here - not elastic IPs
    left=172.16.10.11
    leftcert=vpn.example.com
    leftid=@vpn.example.com
    leftsendcert=always
    leftsubnet=172.16.0.0/16
    leftrsasigkey=%cert
    # Clients
    right=%any
    # your addresspool to use - you might need NAT rules if providing full internet to clients
    rightaddresspool=172.16.11.100-172.16.11.150
    rightca=%same
    rightrsasigkey=%cert
    #
    # connection configuration
    # DNS servers for clients to use
    modecfgdns=172.16.15.6,172.16.15.7
    narrowing=yes
    # added to test more options
    #leftmodecfgserver=yes
    # recommended dpd/liveness to cleanup vanished clients
    dpddelay=30
    dpdtimeout=120
    dpdaction=clear
    auto=add
    ikev2=insist
    rekey=no
    # ikev2 fragmentation support requires libreswan 3.14 or newer
    fragmentation=yes