Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    24.03 causes issue with remote VPN

    IPsec
    2
    11
    795
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      It's probably the Interface Bound state change in 24.03: https://docs.netgate.com/pfsense/en/latest/releases/24-03.html#general

      Try reverting the global setting to floating as a test. If that fixes it you can look at where the state asymmetry is breaking and add specific rules to pass that.

      If your IPSec tunnel is using route mode (VTI) it's probably there.

      Steve

      C 1 Reply Last reply Reply Quote 0
      • jimpJ jimp moved this topic from Problems Installing or Upgrading pfSense Software on
      • C
        canderson @stephenw10
        last edited by

        @stephenw10 yes that fixed it

        i have another appliance that the update completely bricked tho, at a remote site, spent today setting up a spare to mail out to them lol
        when i get the other one back i'll report what happened to it

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Well good and bad news then I guess!

          We have some specific advice up for VTI tunnels with interface states now:
          https://docs.netgate.com/pfsense/en/latest/config/advanced-firewall-nat.html#ipsec-vti-filtering

          Following that should allow you have the global value set to Interface Bound but still pass VTI using floating rules.

          C 1 Reply Last reply Reply Quote 0
          • C
            canderson @stephenw10
            last edited by canderson

            @stephenw10 ok well the spare, an sg-3100, died while i was getting it to recognize the interfaces. here's an issue i run into a lot -- the router that died was no a sg-3100, if you restore a config with mismatched interface names from the original device, in this case i had manually search/replaced most of them in the xml config file but missed one, every boot it will halt and ask if you want to configure vlans.

            i had sent a usb cable with it so i was able to get the remote user to connect it to their laptop, install the usb drivers and connect with putty to the console of the device but nothing you can do from the console will let you bypass this error. maybe some kind of editing the conf file manually? but theres no mechanism from the console

            so i had them connect the wifi to their phone hotspot, the wired interface to the pfsense router, and was able to get to the web interface on the router and delete all the vlans -- and then, i think the sd card in this router died of old age

            so, i'm going to drive 4 hours up there and see if i can fix either of the two routers
            i am crabby about this, mostly the original router dying after the update, we'll see if that was also caused by a faulty sd card.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Urgh, I'm sorry.

              If you import a config file in webgui and there is an interface mismatch it should take you to the assignments page in order to correct that before rebooting. However if you have a lot of sub-interfaces like vlans it can be easier to edit the config directly.

              You can edit the config file directly from the command line using the EasyEditor (ee) and rebooting.

              The 3100 doesn't use an actual SD card, it has eMMC on-board which appears to the OS as mmcsd0. You can fit an m.2 SATA SSD and run from that though.

              C 1 Reply Last reply Reply Quote 0
              • C
                canderson @stephenw10
                last edited by

                @stephenw10 ok the original Netgate SG-2440 was at a 'can't find /kernel/kernel' screen which, athough there is some documentation on the pfsense site, my freebsd knowledge is very poor and i wasn't able to figure out how to fix this, easily, while sitting there
                i ended up restoring from a community edition image and then that worked, restored original config, everything was good
                i will have to dig into what happened to the other unit which is one of the old ARM based units that i'm willing to bet was not kept as a 'spare' but as 'junk you should throw away'
                we'll see!

                C 1 Reply Last reply Reply Quote 0
                • C
                  canderson @canderson
                  last edited by

                  @canderson

                  have been a netgate user for 5 years since inheriting them from predecessor
                  most devices we have are REALLY OLD and have done really well
                  my 2 cents out of this event are:

                  • it would be nice if there was a portal (maybe there is) where i could go download any version of the firmware my license(s) entitles me to while the license(s) are active, it's really only an issue for the wg3100 as there's nowhere to download even community firmware in a 'emergency' like this one
                  • it would be cool if the capabilities of the ISO/boot disk were expanded to make it possible to 'repair an existing installation' somehow, under the assumption the boot/efi/partition/something is damaged or the wrong volume is selected / other stupid things like that that happen over time. i mean, right now its fine for someone who is familiar with freebsd and/or does not have a cluster of employees hovering behind them waiting for the router to come back up :)
                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Feature requests for the new Net Installer are welcome. It can already recover an existing config and use that in a clean install. It doesn't support the 3100 though.

                    C 1 Reply Last reply Reply Quote 0
                    • C
                      canderson @stephenw10
                      last edited by

                      @stephenw10 sorry i meant to follow up and ask, what do you think caused the 'missing /kernel/kernel' on that sg-2440 ?
                      i have another sg-2440 even farther away that i am about to upgrade and i wonder if there are any preventative measures i should check before doing so, free space, correct boot configuration, something like that?

                      thanks for all your help by the way
                      have ordered a new 1100 to replace the dead 3100

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Nothing specific. Is it upgrading from 23.09.1? Running UFS?

                        Some of the early RCC-VE devices like that had very small eMMC storage (4GB) which can be an issue.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S stephenw10 forked this topic on
                        • First post
                          Last post