Is it possible to change the listening port of IPsec VTI？
-
@nogbadthebad said in Is it possible to change the listening port of IPsec VTI？:
@upper-deck That's actually NAT-T & ISAKMP not VTI, but as @gabacho4 says that sucks and try WireGuard or OpenVPN.
Otherwise look in the advanced section, not sure what you'd do with the clients :-
That is "UDP port for remote gateway", right? Should I change the UDP ports on remote gateway first then change these settings?
-
@upper-deck Not a clue to be honest as just had a look at my mobile client phase 1 setting, fortunately I have a sensible ISP.
-
@nogbadthebad on my site to site policy routed IPSec I have fields to change the local ports. How are you seeing remote ports? Which version pfsense and what kind of IPSec connection?
-
@gabacho4 I use IPsec for a mobile road warrior type connection not site to site.
-
Would you mind to share a screen shot of the local ports changing fields? I can only find remote gateway ports options. Thank you.
-
@upper-deck sure thing. Again I am running a policy routed IPsec connection. When I got to VPN -> IPsec -> Advanced Settings, I have:
EDIT: I am running PfSense Plus 22.05 on this particular box.
-
OOOOOH I get what we're missing. You are looking at the Advance Settings on the P1. I was looking at the advanced settings for IPsec writ large. lightbulb! So that means you need to go to the IPsec advanced settings on the router that is having IPsec UDP/500 UDP/4500 blocked (not P1) and set the alternate ports. Then on the other end, you would need to set those ports in the P1 for the connection. I'd probably do the same thing for both sides just so that things are standardized.
-
@gabacho4 I think so
-
-
@upper-deck that is awesome. I’ll play with mine later but this was a cool learning moment to me.
