Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    24.03 causes issue with remote VPN

    IPsec
    2
    11
    795
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      canderson
      last edited by canderson

      So I am not sure which forum this belongs in -- not sure if this is a NAT or IPSEC issue or what
      I have a local network behind a pfsense router, it is connected via an ipsec tunnel to a remote google cloud compute environment, in that environment, there is a wireguard vpn server that people connect to and they can access the LAN behind the pfsense router and everything else they're allowed to
      this has always worked, and instantly breaks in 24.03, and is instantly fixed by reverting to 23.09
      otherwise the 24.03 update was fine
      where should i start here?
      normally when a client connects to the wireguard server, their traffic appears to originate from the ip address of the wireguard server -- this server can still ping devices on the other side of the ipsec tunnel and vice versa, ssh connections both ways are possible, but clients connected to it cannot access anything in the google cloud or the local lan
      i have 5 remote sites, all directly connected via static routed ipsec tunnels to google cloud, they all have the same issue on 24.03, fixed by reverting to 23.09
      actually they are working?? well i guess i found where to start
      thanks if anyone has any ideas

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        It's probably the Interface Bound state change in 24.03: https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#general

        Try reverting the global setting to floating as a test. If that fixes it you can look at where the state asymmetry is breaking and add specific rules to pass that.

        If your IPSec tunnel is using route mode (VTI) it's probably there.

        Steve

        C 1 Reply Last reply Reply Quote 0
        • jimpJ jimp moved this topic from Problems Installing or Upgrading pfSense Software on
        • C
          canderson @stephenw10
          last edited by

          @stephenw10 yes that fixed it

          i have another appliance that the update completely bricked tho, at a remote site, spent today setting up a spare to mail out to them lol
          when i get the other one back i'll report what happened to it

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            Well good and bad news then I guess!

            We have some specific advice up for VTI tunnels with interface states now:
            https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#ipsec-vti-filtering

            Following that should allow you have the global value set to Interface Bound but still pass VTI using floating rules.

            C 1 Reply Last reply Reply Quote 0
            • C
              canderson @stephenw10
              last edited by canderson

              @stephenw10 ok well the spare, an sg-3100, died while i was getting it to recognize the interfaces. here's an issue i run into a lot -- the router that died was no a sg-3100, if you restore a config with mismatched interface names from the original device, in this case i had manually search/replaced most of them in the xml config file but missed one, every boot it will halt and ask if you want to configure vlans.

              i had sent a usb cable with it so i was able to get the remote user to connect it to their laptop, install the usb drivers and connect with putty to the console of the device but nothing you can do from the console will let you bypass this error. maybe some kind of editing the conf file manually? but theres no mechanism from the console

              so i had them connect the wifi to their phone hotspot, the wired interface to the pfsense router, and was able to get to the web interface on the router and delete all the vlans -- and then, i think the sd card in this router died of old age

              so, i'm going to drive 4 hours up there and see if i can fix either of the two routers
              i am crabby about this, mostly the original router dying after the update, we'll see if that was also caused by a faulty sd card.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Urgh, I'm sorry.

                If you import a config file in webgui and there is an interface mismatch it should take you to the assignments page in order to correct that before rebooting. However if you have a lot of sub-interfaces like vlans it can be easier to edit the config directly.

                You can edit the config file directly from the command line using the EasyEditor (ee) and rebooting.

                The 3100 doesn't use an actual SD card, it has eMMC on-board which appears to the OS as mmcsd0. You can fit an m.2 SATA SSD and run from that though.

                C 1 Reply Last reply Reply Quote 0
                • C
                  canderson @stephenw10
                  last edited by

                  @stephenw10 ok the original Netgate SG-2440 was at a 'can't find /kernel/kernel' screen which, athough there is some documentation on the pfsense site, my freebsd knowledge is very poor and i wasn't able to figure out how to fix this, easily, while sitting there
                  i ended up restoring from a community edition image and then that worked, restored original config, everything was good
                  i will have to dig into what happened to the other unit which is one of the old ARM based units that i'm willing to bet was not kept as a 'spare' but as 'junk you should throw away'
                  we'll see!

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    canderson @canderson
                    last edited by

                    @canderson

                    have been a netgate user for 5 years since inheriting them from predecessor
                    most devices we have are REALLY OLD and have done really well
                    my 2 cents out of this event are:

                    • it would be nice if there was a portal (maybe there is) where i could go download any version of the firmware my license(s) entitles me to while the license(s) are active, it's really only an issue for the wg3100 as there's nowhere to download even community firmware in a 'emergency' like this one
                    • it would be cool if the capabilities of the ISO/boot disk were expanded to make it possible to 'repair an existing installation' somehow, under the assumption the boot/efi/partition/something is damaged or the wrong volume is selected / other stupid things like that that happen over time. i mean, right now its fine for someone who is familiar with freebsd and/or does not have a cluster of employees hovering behind them waiting for the router to come back up :)
                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Feature requests for the new Net Installer are welcome. It can already recover an existing config and use that in a clean install. It doesn't support the 3100 though.

                      C 1 Reply Last reply Reply Quote 0
                      • C
                        canderson @stephenw10
                        last edited by

                        @stephenw10 sorry i meant to follow up and ask, what do you think caused the 'missing /kernel/kernel' on that sg-2440 ?
                        i have another sg-2440 even farther away that i am about to upgrade and i wonder if there are any preventative measures i should check before doing so, free space, correct boot configuration, something like that?

                        thanks for all your help by the way
                        have ordered a new 1100 to replace the dead 3100

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Nothing specific. Is it upgrading from 23.09.1? Running UFS?

                          Some of the early RCC-VE devices like that had very small eMMC storage (4GB) which can be an issue.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S stephenw10 forked this topic on
                          • First post
                            Last post