This is a strongSwan updown script that allows Docker containers to be accessed through IPSec VPN on the host.

docker-updown.sh

#!/usr/bin/env bash

# This is a strongSwan updown script that allows Docker containers to be
# accessed through IPSec VPN on the host.

set -e -o pipefail; [[ -n "$DEBUG" ]] && set -x

docker_addr_pools=( $(docker system info -f "{{range .DefaultAddressPools}}{{.Base}} {{end}}") )

case "$PLUTO_VERB" in
  up-client)
    for addr_pool in "${docker_addr_pools[@]}"; do
      sudo iptables -t nat -I POSTROUTING 1 -o "$PLUTO_INTERFACE" -d "$PLUTO_PEER_CLIENT" -s "$addr_pool" -j SNAT --to "$PLUTO_MY_SOURCEIP"
    done
    ;;
  down-client)
    for addr_pool in "${docker_addr_pools[@]}"; do
      sudo iptables -t nat -D POSTROUTING -o "$PLUTO_INTERFACE" -d "$PLUTO_PEER_CLIENT" -s "$addr_pool" -j SNAT --to "$PLUTO_MY_SOURCEIP"
    done
    ;;
esac
# vim: ai ts=2 sw=2 et sts=2 ft=sh

Download the script and move it to /etc/ipsec.d/.

$ chmod +x docker-updown.sh
$ sudo mv docker-updown.sh /etc/ipsec.d/

Modify /etc/ipsec.conf.

conn <name>
     ....
     leftupdown="ipsec _updown iptables && /etc/ipsec.d/docker-updown.sh"