As a follow-on to the Ubuntu post, we have some slightly different hiccups this time! First, get your IKE VPN stuff ready as usual, like server certificate, client user/pass or certificate/key, server IP, etc.

Install all the needed packages. The catch this time was that MSCHAP is not included in the normal packages, Debian apparently chose to include it in libcharon-extauth-plugins. That's right, not extra, extauth.

sudo apt install strongswan strongswan-pki network-manager-strongswan \
libcharon-extra-plugins libcharon-extauth-plugins \
libstrongswan-extra-plugins libstrongswan-standard-plugins \
libtss2-tcti-tabrmd0

Set up the VPN with the appropriate details, and make sure you choose "Request an inner IP address" otherwise you'll probably get an error like received FAILED_CP_REQUIRED notify, no CHILD_SA built; failed to establish CHILD_SA, keeping IKE_SA.

Now if your VPN is like my PfSense, you get assigned a pool IP like 192.168.200.x but the office network is all 10.1.1.x so the "Use this connection only for resources on its network" checkbox doesn't do anything. So there's an additional step, explicitly routing and deleting the default route using a NetworkManager Dispatcher. This assumes that NetworkManager is setting your VPN routing table as number 210 and your desired destinations on the VPN live under 10.1.1.0/24.

sudo vim /etc/NetworkManager/dispatcher.d/99-fix-vpn-policy-routing

#!/bin/bash

if [ "$CONNECTION_ID" = "NetBurner" ] && [ "$2" = "vpn-up" ]; then
    IFACE="$1"

    # Remove default route policy for VPN
    ip rule del table 210 2>/dev/null
    ip route del default dev "$IFACE" table 210 2>/dev/null

    # Add specific policy for 10.x network only
    ip route add 10.1.1.0/24 dev "$IFACE" table 210 2>/dev/null
    ip rule add to 10.1.1.0/24 table 210 2>/dev/null

    echo "Fixed VPN policy routing for split tunneling on $IFACE"
fi

You can verify/troubleshoot with ip rule show ip route show table 210 ip route -- note that you don't want to see default via nm-xfrm or 10.1.1.0, that's your VPN. You want default via 192.168.1.1 dev enp3s0 or whatever your actual LAN is, and another rule that routes only your VPN traffic over the nm-xfrm interface.