Firewall rules for IPSec affecting Wireguard
-
Hello.
I have a Wireguard tunnel connected from pfSense to a remote site.
Windows clients are connected to an IKEv2 server on the pfSense.
There are three separate tabs for these connections on the Firewall rules page: OPT(wireguard assigned interface), Wireguard and IPSec.
Both OPT and Wireguard are currently set to allow all traffic.
But the IPSec connection is limited to allow only commonly used ports.
The problem is, that the rules listed on the IPSec tab are affecting my wireguard connection. For example, if i block ICMP traffic, all ping packets between pfSense and the remote location (connected through wireguard) become blocked. -
Where are you placing those rules?
-
@jknott
IPSec tab: forbid all but port 80 (for example)
Wireguard: Allow all
OPT: Allow allResult: When i ping a host connected through Wireguard, there is no reply. When i put a rule that allows ICMP on the IPSec tab, the ping goes through.
