[mcnallym]

The normal way would be to set the encryption domain to be just the two addresses so that is all that you can reach in the encryption domain.

SecureClient references the user.c file to identify the gateway it should use and the network protected by that gateway.

Normally is pulled down from the encryption domain setting.

On NGX you can set a seperate Remote Access Domain, try setting that to just two ip addresses, update your topology and retry.