Hallo zusammen,
ich habe die Antwort selbst gefunden.
Es geht. Und es geht sowohl mit IPSec, als auch mit openVPN. Den für mich entscheidenden Hinweis in Kombination mit IPSec war dieser hier:
– schnipp --
You need parallel tunnels for this to work. unfortunately routing across a
tunnel doesn't work (yet).
Example:
LAN1-------pfSense1-----(Internet)---------pfSense2-----------LAN2-------ROUTER------LAN3
You have to use different identifiers at both ends for the tunnels as both
tunnels are established between the same public IPs so the traffic of the
tunnels doesn't mix up.
At pfSense1:
create one preshared key like identifier "" with secret "lan2"
(this is for the "unrouted" tunnel)
create one preshared key like identifier "" with secret "lan3"
(this is for the "routing to next hop" tunnel)
At pfSense2 create the same keys.
Now create the tunnels:
The first tunnel is simple as it is for the directly connected LAN-segments at
both pfSenses (LAN1 and LAN2). Create it just like you usually would do but use
the "" identifier and secret at both ends.
The second tunnel works like this:
At pfSense1 (only special settings mentioned that are different from the other
tunnel):
local subnet: lan subnet
remote subnet: LAN3/subnetmask
identifier and secret of ""
At pfSense2:
local subnet: LAN3/subnetmask <–-- !!!
remote subnet: LAN1/subnetmaks
identifier and secret of ""
Additional to this you need a static route at pfSense2 pointing towards LAN3
via gateway ROUTER.
(and of course you need a route at ROUTER pointing to LAN1 via pfSense2)
– schnapp --
Ich habe es in virtuellen Maschinen nachgebaut und es funktioniert bestens.
Bei openVPN war der entscheidende Hinweis dieser hier:
-- schnipp --
Remote network: Enter the remote(Clients) LAN here, to access more than one network, use the custom options field.
-- schnapp --
Und das ganze dann in dem Format:
Additional local subnets should be added to the custom options like so (x.x.x.x is the subnet start IP, y.y.y.y is the subnet mask): push "route x.x.x.x y.y.y.y";
Gruß
Christian
