Problem creating working rules for this setup

[gctwnl]

My WAN: A.B.C.D/29 (5 fixed IP addresses)
My LAN: 192.168.2.2/24
A vlan VLANA: 192.168.3.2/24
My IPsec tunnel for Road Warriors/Mobile Clients:

• IP Pool for the mobile client: 192.168.102.2/24
• Network in Phase 2: 0.0.0.0/0

What I an unable to get working is a way to have the Mobile Client able to use LAN and WAN, but not the VLAN. I've tried all sorts of rules on both the IPsec and the LAN/VLANA, but I get either everything blocked or nothing. I can use a tip.

I'm also still confused about direction, especially in the case of IPsec.