IPSec issues on 24.03 - sessions dropping

michmoor

@jimp
Question Jim. Because this bit me and a few others would it be reasonable to make an exception for IPsec traffic flows and a note in the webUI or documentation about this and to change at the admins own risk?
So the IPsec interfaces with VTI get the floating policy state change only.

stephenw10

The ideal solution here is to fix the IPSec pfil handling so traffic is filtered on the same interfaces in and out as expected. We are looking at that (again) but the work there is non-trivial!

jimp

If fixing the OS level issues doesn't work out we might consider an option for automatically handling the floating policy rules for VTI but we're hoping to avoid that if possible.

maverickws

Hi all,

So from my understanding, please correct me if I'm wrong, if I would maintain the option for Interface Bound, I would add a rule to the Floating rules on the IPsec interface as described in Rules with Floating Policy Set ?

stephenw10

Yes exactly.

maverickws

perfect thank you I will test today and tell how it goes.

maverickws

Ok so I was able to reboot the router and booted into 24.03

I've added the rule as described to the IPsec interface on the floating rules, put it on top of any other IPsec rules and so far my connections seem to be stable, been testing for over 5 minutes both terminal and RDP.

Next week I'll be able to test further. Have a nice weekend you all

danjeman

@maverickws I had this issue today... looks like adding advanced rule options for floating states on the ipsec rules and a floating outbound one too as per the docs does the trick

maverickws

@danjeman howdy.
I only added one floating rule, what you mean by two rules?

stephenw10

If you need to create connections across the tunnel in both directions you need a floating outbound rule with floating state binding set to allow the replies. It's shown in the doc there now.
https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#interface-bound-states

So you might only add one floating rule and edit the existing IPSec rule. Two rules are needed if none existed.