Auto-exclude LAN address feature only works for the LAN interface
The "Auto-exclude LAN address" feature sets up the bypasslan block in strongSwan to exclude the LAN interface specifically from IPsec. Which works great for LAN but unfortunately other local subnets have no way to obtain the same protection for overlapping IPsec P2 networks.
Perhaps the control could be changed to a multi-select for all interfaces, or have a means to work for all local (e.g. interfaces without defined gateways)
Alternately, allowing negation P2 entries as mentioned in #3329 would be acceptable.