The no acceptable traffic selectors found error in the logs is described on the following page which also has a workaround :
Does not seem to be a specific location on Strong Swan's website with syntax for all parameters in swanctl.conf. However I did find the syntax in this page
You cold try strongSwan's user mode IPsec implementation libipsec via the kernel-libipsec plugin. It does require TUN devices, so if that's not possible on your VPS, you're out of luck. And it also has some performance limitations (read the notes on the linked page).
No, most IPsec VPNs will require those modules simply because IPsec is actually handled by the kernel and not by the software which mostly handles keying.
Alternatives would be to use a full user mode reimplementation of IPsec (I only know of test implementations, nothing production grade but feel free to look around) or an alternative full user mode VPN (ie....
To connect from the console, this guide on configuring the client stronswan helped me: https://protonvpn.com/support/linux-ikev2-protonvpn/
In IDE when you first connect your new VPN connection, the NetworkManager-Strongswan asks for a password from the VPN, not from the Sudo. Because of this, when connecting from ide, an authorization error occurred.
It turns out the solution is an additional xfrm policy. The thinking behind it is that whilst packets are getting onto the interface, the traffic isn't being "scooped up" by ipsec. To resolve the problem, it seems we need to mark the packets (in the same way as we do in the ipsec config and iptables), and also to specifically "activate" ...
Working swanctl config of strongswan in client mode when connecting to a L2TP VPN hub with PSK: