BOUNTY: IPSec VPN TUNNEL REDUNDANT 1K$ USD
-
It doesn't work because you can't bring two simultaneous tunnels up for the same traffic…
There are all sorts of issues with racoon crashing also when trying to do failover tunnels on the same box. I wasted a full day writing scripts to manage the failover and testing this out. Basically it is possible in theory, but the FBSD implementation of IPsec doesn't allow it work in practice.
The best way to do it right now is with three machines. Two to set up the tunnels and one to manage the failover/load balacing (if desired).
A one-box solution does not work reliably or seamlessly on FBSD, let alone PFsense! -
I'd like to keep this bounty but I already supplied my client with another solution for IPSec failover. So now I don't need this function actually. But I believe I will need this function for future. So I will reduce the mony to $100 and I will keep this bounty. I think somebody can add some more bounty for this function.
Thanks to pfsense developers and especially thanks to Ollopa.
-
What was the other solution that you found?
Robert
-
-
IPSEC failover works TODAY on 1.0 using CARP + IPSEC Failover feature.
I have been using well before 1.0 was released at my work. 2 firewalls. When the first firewall goes down, all IPSEC traffic still works. I have gone over the setup many times in the forum. No scripts needed, nada, it just works.
-
Sorry for late reply.
I've used other dual wan router in front of pfsense. The dual wan router has a fail over fuction. And I made a script for re-establishing ipsec on pfsense when the failing-over occurs on dual wan router.
What I want is not box redundant. What I want is fail over internet line with ipsec.
Pls read my earlier post.I'm continuing test for this funtion with pfsense snapshot. But until now it does not work. The main prblem that should be solved first is that ipsec does not work at second wan(opt1).
Thanks.
-
I think it should work if you add a static route through the OPT-WAN to the remote endpoint. Maybe you can integrate this in your script and test. If this works we maybe could integrate it into the linkdown detection code (no promise though).
-
I have managed to get IPSEC over OPTx working correctly. I've been testing it on the 3-27-07 updates and .iso's for the full version install. Here is what I've done to make it work:
1. I created the IPSEC definitions on the IPSEC page and chose the OPTx interface that I want to use.
2. I created manual rules for the desired OPTx interface to allow IPSEC traffic to connect to the IP of the pfsense box on that Interface. Specifically, I created rules to allow UDP 500, ESP, AH, and GRE to connect to the Public IP on the OPTx interface.Note, I am using static IP's on all of my WAN type interfaces. All of the routers in front of me are operating in bridged mode and do not do any port forward filtering or NAT type stuff, so if you have private IP's on your OPTx interfaces and the routers in front of them are doing any sort of port forwarding or NAT, you may run into tunnel stability problems.
Vaughn
-
It should be creating the rules on the OPT interfaces behind the scenes but there is a bug preventing it. I am aware of the bug but this week has been nonstop madness at my day job and other engagements that have prevented me from fixing it.
-
It should be creating the rules on the OPT interfaces behind the scenes but there is a bug preventing it. I am aware of the bug but this week has been nonstop madness at my day job and other engagements that have prevented me from fixing it.
There is any solutions now ?
