Some more debugging on the fw:
ping 192.168.2.145
Generates ICMP echo request packages on the gw interface (sk0/sk2), no ICMP echo reply is received (obviously).
Result: ping command gets no answer.
ping -S 192.168.1.10 192.168.2.145
Generates ICMP echo request packages on the ipsec interface (enc0) and the clients answers back with ICMP echo reply packages.
Result: ping command is ok.
route add 192.168.2.144/28 192.168.1.10
ping 192.168.2.145
Generates ICMP echo request packages on the ipsec interface (enc0) and the clients answers back with ICMP echo reply packages.
Result: ping command is ok.
BUT:
Even with the above route, i can ping the client only from the fw itself, but not from the network. I`ve also tried playing with NAT rules to force the fw source address, but no lock so far.
Any further idea to solve the problem?