Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPSEC on OPT1/WAN2?

    Scheduled Pinned Locked Moved IPsec
    17 Posts 5 Posters 8.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      Wasca
      last edited by

      Do you apply the static route to your WAN interface or WAN2 interface?

      So it would be like this

      Interface              Network                          Gateway                   
      WAN2        Remote End IPSEC WAN IP/32      WAN2 Gateway IP

      or

      Interface              Network                          Gateway                   
      WAN        Remote End IPSEC WAN IP/32      WAN2 Gateway IP

      1 Reply Last reply Reply Quote 0
      • P
        Phobia
        last edited by

        This was completely wrong… (deleted)

        1 Reply Last reply Reply Quote 0
        • dotdashD
          dotdash
          last edited by

          Actually, my IpSec tunnels on WAN2 are working with a route like this:
          @Wasca:

          Interface              Network                          Gateway                   
          WAN2        Remote End IPSEC WAN IP/32      WAN2 Gateway IP

          The LAN one doesn't make sense to me, as the problem is the box trying to establish the tunnel from the WAN, not OPT1/WAN2. The remote LAN should not be a factor until after the tunnel is established.

          1 Reply Last reply Reply Quote 0
          • P
            Phobia
            last edited by

            Yeah - but that doesn't help you to route packets over your IPSEC tunnel via the WAN2 interface from LAN.  That is what this static route is for.

            – Phob

            1 Reply Last reply Reply Quote 0
            • H
              hoba
              last edited by

              Don't use gateways for IPSEC-Traffic. This will redirect the traffic directly to the upstream gateway and won't send it into the tunnel. Use gateway default for these rules.

              1 Reply Last reply Reply Quote 0
              • P
                Phobia
                last edited by

                This was the only way I could get anything to work over my IPSEC tunnel on WAN2 - is there another way?

                1 Reply Last reply Reply Quote 0
                • P
                  Phobia
                  last edited by

                  … or is the route needed for WAN2 and not LAN?  I'm not at the location with this setup right now - I will be later tonight and I'll take a look.

                  -- Phob

                  1 Reply Last reply Reply Quote 0
                  • H
                    hoba
                    last edited by

                    Sorry, but that doesn't make any sense. That definately won't work this way. It's simply wrong.

                    You need the static route at the wan2 interface for the remote endpoint/32 through ewan2 gateway. Besides that all firewallrules have to use the default gateway so traffic can make it into the tunnel.

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschliG
                      GruensFroeschli
                      last edited by

                      @hoba: Something that always confused me a bit about the static routes:

                      Is the "Interface" (first thingy in the static route)
                      the interface on which traffic goes out,
                      or the interface to which the route applies to on incomming traffic?

                      We do what we must, because we can.

                      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                      1 Reply Last reply Reply Quote 0
                      • H
                        hoba
                        last edited by

                        it's the interface that the gateway for the remote subnet is located behind.

                        1 Reply Last reply Reply Quote 0
                        • P
                          Phobia
                          last edited by

                          Right - OK.  So the static route is :

                          WAN2  (Remote IPSEC Gateway/Public IP)  WAN2 GW

                          Correct?

                          I was just confused as I'm working in a different location without this setup right now and I got turned around in my brain. :)

                          – Phob

                          1 Reply Last reply Reply Quote 0
                          • H
                            hoba
                            last edited by

                            Correct, besides that it is: WAN2, <remote ipsec="" endpoint="" ip="">/32,<wan2-gateway-ip></wan2-gateway-ip></remote>

                            1 Reply Last reply Reply Quote 0
                            • P
                              Phobia
                              last edited by

                              LOL - OK, total brainfart as that is how it is setup at the my other location.  Oops … like I said at the beginning, mesa confused! :)

                              Thanks as usual guys.

                              -- Phob

                              1 Reply Last reply Reply Quote 0
                              • M mik256 referenced this topic on
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.