BOUNTY: IPSec VPN TUNNEL REDUNDANT 1K$ USD
-
I took a look at this issue but I think there are some FBSD limitations.
First, I was able to get ipsec working on OPT1 by modifying vpn.inc and filter.inc. Right now it looks like the firewall rules for ipsec are hardcoded to the WAN interface. I changed it to add rules based on the interfaces for tunnels but it's a little kludgy.
The real problem, however, is with setkey and the SPDs. You said you use DHCP on the dual WANs. I assume your address are dynamic. I think that poses a problem because you have to specify the end-points of your tunnel with fixed IP addresses. You'll need a mechanism to detect when your WAN's IP changes; then it will have to create new SPDs.
The next problem is that you can't have simultaneous redundant tunnels for the same range of networks as far as I can tell…
You want to have two tunnels come up for the same range of traffic, but setkey won't allow it.
Here's an example spd.conf from my experiments:
spdadd 192.168.20.0/24 192.168.20.1/32 any -P in none;
spdadd 192.168.20.1/32 192.168.20.0/24 any -P out none;
spdadd 192.168.20.0/24 192.168.50.0/24 any -P out ipsec esp/tunnel/192.168.0.2-192.168.0.5/unique;
spdadd 192.168.50.0/24 192.168.20.0/24 any -P in ipsec esp/tunnel/192.168.0.5-192.168.0.2/unique;
spdadd 192.168.20.0/24 192.168.50.0/24 any -P out ipsec esp/tunnel/192.168.0.4-192.168.0.5/unique;
spdadd 192.168.50.0/24 192.168.20.0/24 any -P in ipsec esp/tunnel/192.168.0.5-192.168.0.4/unique;the last two entries will be rejected because a tunnel is already specified for communication between the two networks. Setkey won't let you add additional tunnels...
I noticed this has been discussed to death in previous posts...
Even with ipsec working on OPT1 it's not going to work.
I can only think of two ways to make this happen: write a daemon to manually bring up a new tunnel during failover (not instant, not seamless), or modify setkey/freebsd's ipsec implementation to be aware of interfaces instead of just IP addresses.The latter solution would be nice but it's not something that I think could be quickly or easily implemented.
-
ifstated might be an option here - I don't see a good way to implement this in pfSense so it's generic enough for broad use though. I can see how to make this work, obviously you have to be checking link (and tunnel) status and tear down the SPDs for the WAN tunnel on failover and recreate those SPDs to the OPT1 interface. That takes care of one end…the other end is trickier, how do you allow this new random IP coming in....obviously you can't lock the tunnel down to IPs (and thus ends the research I've done :))
--Bill
-
The tunnel is set up for mobile clients, so it doesn't matter that the other end's IP address changes.
But the problem remains that a tunnel has to be torn down and a new one brought up. It's possible to have a daemon detect failover and respond accordingly, but the process is by no means seamless or instantaneous.
Also a route can go down without an interface going down. Some routing protocol should be used to detect when the route is down rather than when the interface is down.I see that ifstated can use pings to detect if a route is down, so this could work.
It's not instantaneous, however, because of the lag while waiting for a new tunnel to be established.
-
will this work with ipsec for fall over?
server1 server2
lan 10.141.251.1 -> wan 80.1.1.1 vpn1 wan 60.90.12.23 -> 10.142.251.1 lan
vip on lan 10.141.251.2 -> wan 80.1.1.1 vpn2 opt1 60.91.125.243 -> 10.142.251.2 vip on lanroutes on server1:
route add 10.142.251.0/24 gateway 10.142.251.1 metric 0 (vpn1 as default vpn)
route add 10.142.251.0/24 gateway 10.142.251.2 metric 50 (vpn2 as fallover vpn)routes on server 2:
route add 10.141.251.0/24 gateway 10.141.251.1 metric 0 (vpn1 as default vpn)
route add 10.141.251.0/24 gateway 10.141.251.2 metric 50 (vpn2 as fallover vpn) -
It doesn't work because you can't bring two simultaneous tunnels up for the same traffic…
There are all sorts of issues with racoon crashing also when trying to do failover tunnels on the same box. I wasted a full day writing scripts to manage the failover and testing this out. Basically it is possible in theory, but the FBSD implementation of IPsec doesn't allow it work in practice.
The best way to do it right now is with three machines. Two to set up the tunnels and one to manage the failover/load balacing (if desired).
A one-box solution does not work reliably or seamlessly on FBSD, let alone PFsense! -
I'd like to keep this bounty but I already supplied my client with another solution for IPSec failover. So now I don't need this function actually. But I believe I will need this function for future. So I will reduce the mony to $100 and I will keep this bounty. I think somebody can add some more bounty for this function.
Thanks to pfsense developers and especially thanks to Ollopa.
-
What was the other solution that you found?
Robert
-
-
IPSEC failover works TODAY on 1.0 using CARP + IPSEC Failover feature.
I have been using well before 1.0 was released at my work. 2 firewalls. When the first firewall goes down, all IPSEC traffic still works. I have gone over the setup many times in the forum. No scripts needed, nada, it just works.
-
Sorry for late reply.
I've used other dual wan router in front of pfsense. The dual wan router has a fail over fuction. And I made a script for re-establishing ipsec on pfsense when the failing-over occurs on dual wan router.
What I want is not box redundant. What I want is fail over internet line with ipsec.
Pls read my earlier post.I'm continuing test for this funtion with pfsense snapshot. But until now it does not work. The main prblem that should be solved first is that ipsec does not work at second wan(opt1).
Thanks.
-
I think it should work if you add a static route through the OPT-WAN to the remote endpoint. Maybe you can integrate this in your script and test. If this works we maybe could integrate it into the linkdown detection code (no promise though).
-
I have managed to get IPSEC over OPTx working correctly. I've been testing it on the 3-27-07 updates and .iso's for the full version install. Here is what I've done to make it work:
1. I created the IPSEC definitions on the IPSEC page and chose the OPTx interface that I want to use.
2. I created manual rules for the desired OPTx interface to allow IPSEC traffic to connect to the IP of the pfsense box on that Interface. Specifically, I created rules to allow UDP 500, ESP, AH, and GRE to connect to the Public IP on the OPTx interface.Note, I am using static IP's on all of my WAN type interfaces. All of the routers in front of me are operating in bridged mode and do not do any port forward filtering or NAT type stuff, so if you have private IP's on your OPTx interfaces and the routers in front of them are doing any sort of port forwarding or NAT, you may run into tunnel stability problems.
Vaughn
-
It should be creating the rules on the OPT interfaces behind the scenes but there is a bug preventing it. I am aware of the bug but this week has been nonstop madness at my day job and other engagements that have prevented me from fixing it.
-
It should be creating the rules on the OPT interfaces behind the scenes but there is a bug preventing it. I am aware of the bug but this week has been nonstop madness at my day job and other engagements that have prevented me from fixing it.
There is any solutions now ?