When installing a route over a tun device for a virtual IP, the route must be set over the tun, not the IKE interface.