ipsec.conf

config setup
    charondebug="ike 4"

# Set up three identical connections differing only in user name and statically assigned /64 IP range.

conn %default
    auto=add
    type=tunnel
    keyexchange=ikev2
    # Verizon's carrier bundle asks for this.
    ike=aes256-sha1-modp1024
    left=%any
    leftid=%any
    leftauth=secret
    # Anything going over my local prefix goes over the tunnel; otherwise split
    leftsubnet=fdad:dabb:ed::/48
    right=%any
    rightauth=secret
    rightsendcert=never
    # It doesn't need a DNS.
    #rightdns=


conn ikev2-vpn-iphone
    rightid=iphone
    rightsubnet=fdad:dabb:ed:1::/64
    rightsourceip=fdad:dabb:ed:1::1

conn ikev2-vpn-android
    rightid=android
    # no idea if Android needs a /64; give it one anyways
    rightsubnet=fdad:dabb:ed:2::/64
    rightsourceip=fdad:dabb:ed:2::1

conn ikev2-vpn-voipapp
    rightid=voipapp
    # this is not for VoWiFi, so a regular /128 would work; assign it a /64 anyways to be consistant
    rightsubnet=fdad:dabb:ed:3::/64
    rightsourceip=fdad:dabb:ed:3::1