We only need apex to reach the intranet so it will be raccoon the only peer that uses intranet IPs as source. All other peers must accept them from raccoon, but not the other way around.
