anyone have ipsec vpn passthru working?

[nrf]

somewhere around 16.7 I lost the ability to use my at&t network client which uses ipsec. do I need to declare that only one IP can do ipsec passthru and forward port(s) there? seems even many cheap routers have checkboxes for enabling ipsec passthru, lt2p passthru, etc....
any advice welcome. thanks in advance!
nrf